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ARE THE FEDERAL GOVERNMENT’S CRITICAL 
PROGRAMS READY FOR JANUARY 1, 2000? 


TUESDAY, APRIL 13, 1999 


House of Representatives, Subcommittee on Gov- 
ernment Management, Information, and Tech- 
nology OF THE Committee on Government Reform, 

JOINT WITH THE SUBCOMMITTEE ON TECHNOLOGY OF 

THE Committee on Science, 


Washington, DC. 

The subcommittees met, pursuant to notice, at 1:07 p.m., in room 
2318, Rayburn House Office Building, Hon. Connie Morelia (chair- 
woman of the Subcommittee on Technology) and Hon. Stephen 
Horn (chairman of the Subcommittee on Government Management, 
Information, and Technology) presiding. 

Present: Representatives Morelia, Horn, Biggert, Ose, Turner, 
Gutknecht, Miller, Barcia, Rivers, Stabenow, and Jackson-Lee. 

Staff present from the Subcommittee on Government Manage- 
ment, Information, and Technology: J. Russell George, staff direc- 
tor and chief counsel; Matt Ryan, senior policy director; Bonnie 
Heald, director of communications, and professional staff member; 
Mason Alinger, clerk; Richard Lukas, intern; Faith Weiss, minority 
counsel. Committee on Government Reform; and Earley Green, mi- 
nority staff assistant. Committee on Government Reform. 

Staff present from the Subcommittee on Technology: Jeff Grover, 
staff director; Ben Wu, professional staff member; Joe Sullivan, 
clerk; Michael Quear and Martin Raison, minority professional 
staff members. 

Mrs. Morella. The joint hearing of the Technology Sub- 
committee of the Science Committee as well as the Subcommittee 
on Government Management, Information, and Technology of the 
Government Reform Committee will come to order. 

On March 31st, the administration announced that, according to 
the most recent data obtained from agencies, 92 percent of Federal 
systems had met the governmentwide goal of Y2K compliance. 
With less than 8 V 2 months remaining until January 1, 2000, it is 
heartening to hear that nearly all mission-critical systems within 
the 24 major Federal departments and agencies are Y2K compliant. 

The administration tells us that these systems have been tested 
and implemented, and will be able to accurately process data into 
the year 2000. This is certainly a welcome change from a year ago, 
and it is a tribute to the thousands of dedicated and skilled Federal 
employees who have been working to ensure that critical govern- 
ment operations and services will continue uninterrupted into the 
next millennium and beyond. 


( 1 ) 
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While progress appears to have been made in addressing Y2K in- 
ternally, each agency must now begin the more vital function of 
outlining actions that are needed for systems to work externally. 
The new challenges facing each agency include performing end-to- 
end testing, as well as developing business continuity and contin- 
gency planning. These challenges are certainly not minor. No one 
should be fooled or lulled into the false sense of security over the 
recent Federal Y2K improvements. Much more work remains to be 
done to ensure the continuity of our critical Federal programs and 
systems. We, in Congress, will continue to provide vigilant Y2K 
oversight and intend to work diligently and cooperatively with the 
administration to ensure the delivering of vital services to the 
American people. 

Today we have a distinguished panel of witnesses to assist our 
House Y2K Working Group in receiving a current status report on 
the efforts of the U.S. Government in correcting the year 2000 com- 
puter problem after the President’s March 31, 1999 deadline. 

This hearing will present the Office of Management and Budget 
and the General Accounting Office with an opportunity to comment 
on the administration’s year 2000 efforts. In addition, this hearing 
will lay the groundwork for the administration to demonstrate the 
overall readiness of its critical business functions — functions that 
the American public rely upon. 

There will also be testimony from four agencies that have yet to 
testify in joint Y2K hearings before the Technology Subcommittee 
and the Government Management, Information, and Technology 
Subcommittee. And that is the Department of Agriculture, the 
Agency for International Development, the Department of State, 
and the Department of the Treasury. It should be noted, however, 
that these 4 agencies were among the 11 agencies that were not 
yet totally compliant by the March 31st deadline. 

I look forward to hearing from our panel, and I am now going 
to turn to the co-Chair of this hearing, the chairman of the Govern- 
ment Management, Information, and Technology Subcommittee, 
the gentlemen from California, Mr. Horn. 

Mr. Horn. Thank you very much. Madam Chairman. We have 
just passed a significant milestone in the Federal Government’s ef- 
forts to update its computers systems for the year 2000. On March 
31st, the President’s deadline for all mission-critical computers to 
be year 2000 compliant, 92 percent of the Government’s depart- 
ments and agencies reported that their 6,123 mission-critical com- 
puter systems are ready for the new millennium. We, in Congress, 
are pleased with this progress, considering that only three short 
years ago several agencies were unaware of the programming 
glitch that could shut down or corrupt their computer systems on 
January 1, 2000. 

A lot of hard work has been going on inside the executive branch 
of the Federal Government. Nevertheless, 8 percent of the agencies’ 
mission-critical systems failed to meet the President’s March 31st 
deadline. These systems, found within 11 departments, are vital to 
the health and well-being of millions of Americans. They must be 
fixed before we can focus entirely on end-to-end testing. From food 
stamps to Medicare and Medicaid, these programs serve our most 
vulnerable citizens — the seniors, the poor, the chronically ill. 
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Today’s hearing marks the beginning of a new phase in our year 
2000 oversight. We will move from our focus on computer systems 
to begin examining entire Federal programs. We want to be as- 
sured that these programs operate seamlessly, whether the date is 
December 31, 1999, or January 1, 2000. We are pleased to welcome 
the witnesses before us today, and I look forward to their testi- 
mony. 

Thank you. Madam Chairman. 

Mrs. Morella. Thank you. Chairman Horn. 

It is now my pleasure to recognize the ranking member of the 
Technology Subcommittee, the gentlemen from Michigan, Mr. Bar- 
cia. 

Mr. Barcia. Thank you. Chairwoman Morella and Chairman 
Horn. I want to join my colleagues in welcoming everyone to this 
afternoon’s hearing. And while this series of hearings on Federal 
agencies’ Y2K efforts have been largely critical of the administra- 
tion, I would like to take this opportunity to compliment their re- 
cent efforts. 

Last Wednesday, the White House announced that 92 percent for 
Federal Michigan — excuse me, mission 

Mrs. Morella. Michigan — see? [Laughter.] 

Mr. Barcia [continuing]. Michigan, my home State — mission-crit- 
ical systems were now Y2K compliant. In fact, 13 of the largest de- 
partments reported 100 percent compliance with their Michigan — 
excuse me, mission-critical systems. [Laughter.] 

In addition, the FAA recently tested its systems at Denver 
Stapleton Airport and found no noticeable problems. Ultimately, 
while much work remains to be done, our Federal agency should 
be commended for their efforts. I also want to commend 0MB for 
their leadership on this issue. A recent memo to the agency heads 
from Jack Lu highlights the need to ensure that not only must 
agency systems be compliant, but that their data exchange part- 
ners be Y2K compliant as well. Further, Director Lu called for the 
need to publicly demonstrate the overall readiness of integrated 
Federal, State, and private systems, as well as the programs that 
they support. I am pleased to see 0MB take this leadership role, 
as Director Lu’s memo outlines my own concerns regarding Federal 
Y2K efforts. 

Recognizing the need to share detailed information with the pub- 
lic, testing data exchanges, and developing complementary busi- 
ness contingency plans are consistent with key provisions in H.R. 
4682, which I introduced at the end of the last Congress. 

As I said earlier, much work remains to be done, and today we 
will hear from four agencies who are behind schedule. However, 
given the bleak prognosis we heard 1 year ago, much progress has 
been made and credit should be given where credit is due. I want 
to thank all of the witnesses for appearing before the committee, 
and I look forward to your comments. 

Thank you. Madam Chairman. 

Mrs. Morella. Thank you, Mr. Barcia. 

I would now like to recognize Mr. Turner, the gentleman who is 
on the Government Reform Committee, for any opening comments 
he may have. 
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Mr. Turner. March 31st was the self-imposed deadline for the 
executive branch to have implemented Y2K-compliant computer 
systems and, as of that date, the Federal Government reported that 
92 percent of its systems were compliant. This is evidence of a 
strong commitment and solid progress in the executive branch on 
the issue. 

The Federal Government, of course, cannot afford to relax its ef- 
forts. A number of significant Federal agencies have not finished 
their Y2K conversion, as has been revealed by this subcommittee’s 
review of the status of the Department of Defense and the Federal 
Aviation Administration, both of which are behind in their repairs. 
Today we will consider the status of Y2K conversion in several 
other agencies, including the Departments of State, Treasury, Agri- 
culture, and the Agency for International Development. 

Conversion work is not finished when the systems are repaired; 
systems must be tested. The Government must conduct end-to-end 
and business continuity testing for significant Federal systems. 
That is, instead of simply testing one system individually, the Gov- 
ernment must test how well its systems coordinate with other sys- 
tems in performing business functions. 

Successful functioning of Government systems on January 1, 
2000 will require coordination and testing of Federal, State, and 
local computer systems, as well as those in the private and non- 
profit sectors. Government functions not only cross departmental 
lines, but also cross Federal, State, and local jurisdictions. It is 
clearly not enough to assure that the Federal systems work, be- 
cause States administer many important Federal benefits, and if 
these State systems fail, people will not get their benefits, and the 
Federal Government will in turn fail. 

Therefore, I would like to thank the witnesses who are gathered 
here today to explain the remaining work that the Federal Govern- 
ment will be undertaking before the date change, and I would urge 
that this effort be devoted to assuring that the Federal, State, and 
local systems collectively can deliver the necessary benefits and 
crucial government services. 

Thank you. Madam Chairman. 

Mrs. Morella. Thank you, Mr. Turner. 

[The prepared statement of Hon. Judy Biggert, Hon. Sheila Jack- 
son-Lee, and Hon. Debbie Stabenow follow:] 
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Statement of Representative Judy Biggert (IL-13) 

Government Management, Information and Technology 
Subcommittee Hearing on Year 2000 Progress 
April 13, 1999 

I am pleased to be able to participate in this hearing about the status of Year 2000 progress for 
federal departments and agencies. I would like to commend Subcommittee Chairman Steve 

Horn. Hiuwwpi^^or the last three Congresses, has ensured that our federal government will be 

oJorK. 

ready for the new Millennium. As the Vice Chair of Mr. Horn’s Subcommittee on 
Government Management, Information and Technology, I too, am committed to the oversight of 
our federal progress in preparation for the year 2000. 

I also came today from a Banking Committee hearing on the status of our nation’s financial 
institutions. I am happy to report that at least this segment of our private sector is progressing as 
well on Y2K compliance and readiness^ ^ 

Icoo- 

Numerous federal departments made significant jumps in the number of “mission critical” 
systems that are now ready for the Year 2000. However, some of our federal departments and 
agencies still have a long way to go to ensure that our nation will not bedisrupted by the coming 
of the new Millennium. Mvj progress Iv •P' 

Although today’s hearing focuses on federal departments and agencies, the readiness of 
individual states is also a great concern to the Subcommittee on Government Management. As a 
former State Legislator, I look forward to the Subcommittee’s continued educational and 
oversight outreach to States. I know that the Subcommittee has scheduled a field hearing in 
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Indiana to talk about that state’s readiness. I hope that we will continue to have hearings in 
individual states to ensure and augment state readiness. 

To be ready for the year 2000, we must all work together. Indeed the nature of this problem 
requires the attention and commitment of local governments, small businesses, states, federal 
departments, and citizens. I look forward to today’s hearing and the tesHmony as to the levels of 
readiness in various departments. Although we are moving forward, we have much to do to be 
ready for the new millennium. And as we all know, the Year 2000 won’t wait. 
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Statement 

Congresswoman Sheila Jackson Lee 
Subcommittee on Technology 
Hearing on V2K and the Federal Government 
April 13, 1999 



I would like to thank Chairwoman Morelia ana Ranking 
Member Barcia, as well as Chairman Horn and Ranking Member 
Turner, for continuing to hold these hearings on the Y2K problem. 


This hearing, which coincides with the President’s self- 
imposed deadline for “critical path” readiness, is also timely 
because it gives us a chance to catch our breath and once again 
return to our Y2K oversight in a fairly broad maimer. This 
hearing, in fact, gives us a chance to look at the overall 
performance of the federal government in a way not done for 
several months. 


Needless to say, while I have been encouraged in the past 
few weeks to read of successful Y2K tests performed by agencies 
like the Federal Aviation Administration (FAA) and the Small 
Business Administration (SBA) on “critical path” systems, I know 
that not all of our agencies have faired as well. 

Before us today are representatives from agencies that have, 
for some reason or another, failed to meet the President’s deadline 
of March 3 1 of this year. While I believe it is pmdent for us to 
search for answers to why these agencies have not performed 
better, I would also like to stress that we do so only out of concern. 
The Y2K problem is one of inestimable size, and I believe that 
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each of us on these Committees feels that our actions now could 
spare us a great deal of grief later. 

Furthermore, while I believe this hearing will be a productive 
one, I also believe it may be in our best interests to have a similar 
hearing which focuses on some of the agencies that have done well 
with their Y2K preparedness. Perhaps during that hearing, we 
could find some of the planning and action that was done at each 
of those agencies instmctive for our more difficult cases. 

Nonetheless, I am eager to hear the testimony from our 
wimesses today, and look forward to working with all of you on 
this issue in the coming months. Thank you. 
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SUBCOMMITTEE ON TECHNOLOGY 

HEARING ON THE STATUS OF THE FEDERAL GOVERNMENT’S PROGRESS IN 
FIXING THE ’YEAR 2000 COMPUTER PROBLEM 


Opening Statement of Congresswoman Debbie Stabenow 
of the 8* District, State of Michigan 

April 13, 1999 


Madame Chairwoman, I thank you and the ranking member, Mr. Barcia, for your 
continued vigilance in regard to the Y2K problem. It is important that we know the extent of the 
federal government’s preparedness in order to better alert the populace to how services may be 
affected. We have a great responsibility to do our best to educate our constituents on this issue. 
This February and last year I held Y2K forums in my district that addressed this issue, and I 
would like to take a moment to thank one of our witnesses, Joel Willemssen, for his help in 
planning those events. They were well-attended and went a long way toward making this issue 
more accessible. 

I believe the government is making good progress toward total Y2K compliance. We 
have a recent example of this, with the General Accounting Office verifying that the Federal 
Reserve Board is 98% Y2K-ready. Overall, 92% of mission-critical systems are compliant, but 
there is still work to be done. I am anxious to hear from the agencies that will be testifying before 
us today as to how their efforts are proceeding. A particular point that should be addressed is 
how prepared are contractors, the states, and other entities that help federal agencies provide 
essential services? Many small businesses are included in this group, and small businesses in 
general have been slower to tackle the Y2K problem and have reached a less advanced stage of 
readiness. At some level this needs to be taken into account when assessing total federal 
compliance. 

Madame Chairman, I look forward to the proceedings today and again appreciate the 
attention the Subcommittee has given this important problem. 1 would also like to thank our 
witnesses for their time and expertise. With everyone’s concerted efforts, we will undoubtedly 
make the Y2K problem a thing of the past. 
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Mrs. Morella. Distinguished panelists, I am going to ask them 
if they will rise, since it is a policy of this committee to swear in 
those who will testify and raise your right hands. 

[Witnesses sworn.] 

Mrs. Morella. The record will indicate affirmative response 
from all, and we do have a distinguished panel. 

We have Ms. Deidre Lee, who is the Acting Deputy Director for 
Management of the Office of Management and Budget; Mr. Joel 
Willemssen, who is no stranger to this committee, who is the Direc- 
tor of Civil Agencies Information Systems of the U.S. General Ac- 
counting Office; we have Ms. Ann Reed, who is the Chief Informa- 
tion Officer of the U.S. Department of Agriculture; we have Rich- 
ard Nygard, who is the Chief Information Officer for the U.S. Agen- 
cy for International Development; we have Mr. Fernando Burbano, 
who is the Chief Information Officer for the U.S. Department of 
State, and we have Mr. James Flyzik, who is the Chief Information 
Officer for the U.S. Department of Treasury. 

Ladies and Gentlemen, it is customary that we give you each 
about 5 minutes maximum. Anything that you have submitted to 
us in its entirety will be included in the record, and that gives us 
an opportunity, then, to fire away with any questions. 

So, if that order is acceptable to you, we will start off then with 
you, Ms. Lee. 

STATEMENTS OF DIEDRE LEE, ACTING DEPUTY DIRECTOR 
FOR MANAGEMENT, OFFICE OF MANAGEMENT AND BUDGET; 
FERNANDO BURBANO, CHIEF INFORMATION OFFICER, U.S. 
DEPARTMENT OF STATE; RICHARD NYGARD, CHIEF INFOR- 
MATION OFFICER, U.S. AGENCY FOR INTERNATIONAL DE- 
VELOPMENT; ANNE F. REED, CHIEF INFORMATION OFFICER, 
U.S. DEPARTMENT OF AGRICULTURE; JOEL C. WILLEMSSEN, 
DIRECTOR, CIVIL AGENCIES INFORMATION SYSTEMS, U.S. 
GENERAL ACCOUNTING OFFICE; AND JAMES J. FLYZIK, 
CHIEF INFORMATION OFFICER, U.S. DEPARTMENT OF THE 
TREASURY 

Ms. Diedre Lee. Are we on? 

Mrs. Morella. Yes. 

Ms. Diedre Lee. Very good. 

Good afternoon. Chairwoman Morella, Chairman Horn, members 
of the subcommittee. 

As you know, I have been Acting Deputy Director for Manage- 
ment since April 1st. And as any average person, I am certainly 
aware of the Y2K issue. But I am still somewhat new to this issue 
at 0MB, and I have been working closely with the 0MB staff to 
come up to speed. I am pleased to appear before the subcommittee 
today to discuss the Government’s progress on the year Y2K. I will 
do my best to answer your questions. 

Chairwoman Morella and Chairman Horn, I would like to start 
by thanking you and the other members of the subcommittee for 
your ongoing interest in Y2K problem and its potential implications 
for our country. Your focus has increased awareness, emphasized 
the importance of the remediation activities, and helped to ensure 
that we will be ready. 
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Today, I would briefly like to address the progress that has been 
made in the Federal arena; our challenges and next steps, and 
funding. 

As you know, the administration has been working for more than 
3 years on the problem. Agencies have been working through the 
phases of awareness, assessment, renovation, validation, and im- 
plementation. Each phase has been a challenging one as Federal 
agencies work through the process of systematically identifying and 
prioritizing mission-critical systems; addressing the implications of 
the systems and equipment containing embedded chips, such as se- 
curity systems, heating and air conditioning units, et cetera; work- 
ing with data exchange partners; testing and retesting systems; 
and working with service-delivery partners such as contractors, 
banks, vendors. State, local, and tribal governments to ensure that 
the programs will be ready, and they can be supported by the Fed- 
eral Government. 

Last year, former Director Franklin Raines established the ambi- 
tious goal of having 100 percent of the Federal Government’s mis- 
sion-critical systems Y2K compliant by March 31, 1999 — well 
ahead of many private sector system remediation schedules. I am 
pleased to report, as you have all noted, that the Federal Govern- 
ment nearly achieved this goal. As John Koskinen and former Dep- 
uty Director for Management, Ed DeSeve, noted at the National 
Press Club on March 31st, “92 percent of the Federal Government’s 
mission-critical systems met the governmentwide goal of being Y2K 
compliant by March 31, 1999. These systems have been remedi- 
ated, tested, and they are back in operation.” 

This represents a dramatic improvement from the progress of the 
Federal Government a year ago, when in February 1998, only 35 
percent of the agency mission-critical systems were compliant. 
Overall progress in the Federal Government is a tribute to the 
hard work, skillful and dedicated work of thousands of Federal em- 
ployees and contractors. And while much work remains to be done, 
we fully expect the Government’s mission-critical systems will be 
Y2K compliant before January 1, 2000. 

While several agencies are here to discuss their specific 
progress — and you noted Treasury Department, the Department of 
Agriculture, the State Department, and the U.S. Agency for Inter- 
national Development — I will provide you with some overall fig- 
ures. And, again, as you noted, 13 of the 24 major departments 
now report that 100 percent of their mission-critical systems are 
Y2K ready, and those are listed in my full testimony, so I will move 
on. 

Of the remaining, three agencies are between 95 and 99 percent; 
four between 90 and 94 percent ready; and three between 85 and 
90 percent. So, we are up there in the higher percentage ratings. 

Based on monthly agency reports received April 10th — so there 
is a little bit of an update here — we gained 1 percent over the last 
week, and we are now at 93 percent ready. And from a base of 
about 6,100, critical systems 408 remain to be finished. And of 
those, 163 are non-defense and 245 are defense. 

We are preparing to issue guidelines asking the agencies to re- 
port, beginning May 15th, on their remaining mission-critical sys- 
tems by name and to include a timetable for completing the work. 
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And then, agencies will report monthly. So, that will identify our 
mission-critical systems. 

Agencies have set realistic goals for the completion of their work 
and are working hard to finish these systems. We are confident 
that every mission-critical system will be ready by year 2000. How- 
ever, the critical task is to make sure that not just systems, but 
the programs that they support will be ready. In response, we are 
taking a look at the Federal Government from the individual’s 
point of view to determine what programs have the most direct and 
immediate impact on the public. 

On March 26th, 0MB issued guidance to the agencies that iden- 
tified 42 high-impact programs and directed Federal agencies to 
take the lead on working with Federal agencies. State, tribal, and 
local governments, contractors, banks, and others to ensure that 
these programs critical to public health, safety, and well-being will 
provide undisrupted services. Examples include Medicare, unem- 
ployment insurance, disaster relief, weather service, et cetera. 
Agencies have also been asked to help their partners develop year 
2000 programs and to ensure that their reports are ready, if they 
have not already done so. Our goal is to publicly demonstrate that 
these programs will operate seamlessly. 

By March 15, 1999, agencies have also been asked to provide to 
0MB a schedule and milestones for key activities in each plan, a 
monthly report of progress against that schedule, and a plan date 
for an event or events to announce that the program as a whole 
is Y2K ready. Clearly, this initiative requires a great deal of co- 
operation and hard work, but success is in everyone’s interest. 

And while these programs are critical to the work of government, 
the smooth operations of government also rely on functions that 
may not have an immediate and direct effect on the public at large, 
but, nevertheless, are essential to sound management of the agen- 
cy, such as financial management systems or personnel systems. 
These functions have been identified as core business functions, 
and are also being worked. 

Agencies are developing business continuity and contingency 
plans to assure that their core business functions will operate. We 
have directed the agencies to follow the GAO guidance on pre- 
paring their plans, and additionally, many agencies are working 
closely with their Inspectors General and/or expert contractors in 
the development of the plans. While it is expected that the business 
continuity and contingency plans will continue to change through 
the end of the year, as agencies update and refine their assump- 
tions, and as they continue to test and modify their plans, we have 
asked agencies to submit their plans no later than June 15. We 
will work with the agencies to assure governmentwide consistency 
of their basic assumptions surrounding the year 2000. 

Funding: The most recent allocation of Y2K emergency funding 
transmitted on April 2, 1999, provides a total of $199 million to 20 
Federal agencies. Fourteen of these agencies have received emer- 
gency funding in earlier allocations, and funding will be used for 
various Y2K compliance activities, including testing to ensure that 
the systems are Y2K compliant; replacement of embedded com- 
puter chips; creation and verification of continuity of operation and 
contingency planning; and cooperative activities with non-Federal 
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entities in support of the President’s Council on Year 2K Conver- 
sion. 

Agencies have benefited greatly from access to emergency funds 
and much of their progress can be credited to this. Continued ac- 
cess to emergency funding is essential to continued progress on the 
Y2K problem. However, the Senate version of the fiscal year 1999 
emergency supplemental appropriation bill would reduce the non- 
defense Y2K emergency fund by $973 million. I urge the conferees 
to strike this reduction, which is unwise at this time. Not only 
would it eliminate the remaining balance in the emergency fund of 
approximately $500 million, but it would also force agencies to stop 
planned and ongoing procurements for Y2K-related activities. It 
would also force agencies to terminate contracts, where this can be 
done without penalty, in order to recapture the additional $468 
million. 

Resources must remain available for agencies to carry out ag- 
gressive strategies to achieve compliance and to develop and imple- 
ment contingency plans that will ensure uninterrupted operations 
and service delivery. In recent months, the pace toward achieving 
governmentwide compliance has quickened considerably. Much of 
this improvement can be attributed to the emergency fund, which 
has ensured that adequate resources remain available to agencies 
as they develop and refine effective strategies for achieving Y2K 
compliance. With the year 2000 approaching, we should build on 
our success, not take steps to undermine it. 

In conclusion, during the 262 days remaining before the year 
2000, we plan to complete work on the remaining mission-critical 
systems, with monthly reports beginning May 15th; we plan to con- 
duct end-to-end testing with the States and other key partners, 
placing special emphasis on readiness of programs that have a di- 
rect impact on the public; and we plan to test and complete busi- 
ness continuity and contingency plans, are due by June 15th. 

This is a busy time, so I would like to thank you very much for 
the opportunity to allow me to share this information with you on 
the administration’s progress. 0MB remains committed to working 
with the committee and the Congress on this critical issue, and I 
would be pleased to answer any questions you may have. 

[The prepared statement of Ms. Lee follows:] 
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Good afternoon, Chairman Horn and Chairwoman Morelia. As you know, I have been serving 
as Acting Deputy Director for Management since April 1. Although I am still somewhat new to this 
issue, I have been working closely with 0MB staff to come up to speed. I am pleased to appear 
before the subcommittees to discuss the government’s progress on the year 2000 problem, and I will 
do my best to answer your questions. Chairman Horn and Chairwoman Morelia, I would like to start 
by thanking you and the other members of the subcommittees for your ongoing interest in the Y2K 
problem and its potential implications for our country. 

Today I would briefly like to address the progress that has been made in the Federal arena, our 
challenges and next steps, and funding. 

As you know, the Administration has been working for more than three years on this problem. 
Agencies have been working through the phases of awareness, assessment, renovation, validation, and 
implementation. Each phase has been a challenging one, as Federal agencies worked through the 
process of systematically identifying and prioritizing mission critical systems; addressing the implications 
for systems and equipment containing embedded chips, such as security systems, heating and air 
conditioning units; working with data^exchange partners; testing and retesting systems; and working with 
service delivery partners, such as contractors, banks, vendors, and State, local, and tribal government 
to the ensure the readiness of programs supported by the Federal government. 

Last year, former Director Franklin Raines established the ambitious goal of having 100 percent 
of the Federal government’s mission-critical systems Y2K compliant by March 31,1 999 - well ahead 
of many private sector system remediation schedules. I am pleased to report that the Federal 
government nearly achieved that goal. As John Koskinen and fonner Deputy Director for Management 
Ed DeSeve noted at the National Press Club on March 3 1 , 92 percent of the Federal government’s 
mission critical systems met the government wide goal of being Y2K compliant by March 31, 1999. 

These systems have been remediated, tested, and are back in operation. 

This represents dramatic improvements from the progress of the Federal government a year 
ago, when in February of 1998, only 35 percent of agency mission critical systems were compliant. 

I 


V 
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Overall progress in the Federal government is a tribute to the hard, skillful, and dedicated work of 
thousands of Federal employees and contractors. And while much work remains to be done, we fully 
expect that all of the Government's mission critical systems will be Y2K compliant before January 1 , 


2000 . 


While several agencies are here today to discuss their progress - the Tre^ury Department, the 
Department of Agriculture, the State Department, and the U.S. Agency for International Development 
- 1 will provide you with some overall figures. Thirteen of the 24 major Federal depatments and 
agencies now rejxiit that 100 percent of their mission critical systems are Y2K compliant. These 
agencies are: the Departments of Education, Housing and Urban Development, Interior, Labor, and 
Veterans Affairs; the Environmental Protection Agency, the Federal Emergency Management Agency, 
the General Services Administration, the National Science Foundation, the Nuclear Regulatory 
Commission, the Office of Personnel Management, the Social Security Administration, and the Small 
Business Administration. 

In addition, three agencies report that between 95 and 99 percent of their mission critical 
systems are compliant and that they expect to be finished soon. These agencies are the National 
Aeronautics & Space Administration, the Department of Energy, and the Department of Commerce. 
Four agencies report that between 90 and 94 percent of their mission critical systems are compliant: 
the Department of Justice, the Department of Agriculture, the Treasury Department, and the 
Department of Health and Human Services. Finally, three agencies report that between 85 and 90 
percent of their mission critical systems are compliant: the Department of Defense, the State 
Department, and the Department of Transportation. The U.S. Agency for International Development 
has not yet completed Implsmentatio.n of its seven mission critical systems. 

Based on monthly agency reports received April 10, 93 percent of mission critical systems are 
now complete - an increase of one percent within the last two weeks. From a base of 6,433 mission 
critical systems at this time, 408 mission critical systems remain to be finished. Excluding the 
Department of Defense, 1 63 mission critical systems are working towards dates that are beyond the 
March 31, 1999, government wide goal. Within the Department of Defense, 245 systems are working 
towards dates beyond the government wide goal. We are preparing to issue guidance to agencies, 
asking agencies to report, beginning May 1 5, on Uicir remaining mission critical systems by name and to 
include a timetable for completing the work. Agencies will report monthly on their progress. 

Agencies have set realistic goals for the completion of their work and are working hard to finish 
fixing these s>^tems. We are confident that every mission critical system will be ready for the year 
2QQ0. Detail on the status of systems behind schedule as of February 15, including projected 
completion dates, was provided in OMB’s last quarterly report to Congress. 

As I have just related to you, we are confident that systems will be ready. However, the critical 
task is to make sure that not just systems, but the programs they support, will be ready. In response, 
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we are taking a look at the Federal government Ae individuaFs point of view to determine what 
programs have the most direct and immediate impact on the public. 

Accordingly, on March 26, 1999, 0MB issuoi guidance to the agencies that identified 42 “high 
impact” Federally supported programs and directed Fecteral agencies to take the lead on working with 
other Federal agencies, State, Tribal, and local governments, conhactors, banks, and others to ensure 
that programs critical to public health, safety, and well-being will provide undisrupted services. 
Examples include Medicare and Unemployment Insurance. Agencies have also been asked to help 
partners develop year 2000 plans if they have not already done so to ensure that the program will 
operate effectively. Such plans are to include end-to-eiKi testing, developing complementary business 
continuity and contingency plans, ^d sharing key information on readiness with partner organizations 
and with the public. Agencies have been asked to report to OMB on their work. Our goal is to 
publicly demonstrate that these programs will work. 

By April 1 5, 1999, agencies have also been asked to provide to OMB a schedule and 
milestones for key activities in each plan, a monthly report of progress against that schedule, and a 
planned date for an event or events to announce that the pro^am, as a whole, is year 2000 ready. 
Ci^riy, this initiative requires a great deal of cooperation and hard work, but success is in everyone’s 
interest. 

And while these programs are critical to the work of government, the smooth operations of 
government also rely on functions that may not have an immediate and direct effect on die. public at 
large, but are nevertheless essential to sound management of the agency, such as financial management 
systems or personnel systems. These functions, which include high impact programs, have been 
identified as core business functions. 

Agencies are developing Business Continuity and Contingency Plans (BCCPs) to assure that 
their core business functions will operate. While agencies are confident that the measures taken for 
Y2K compliance are sound, the chance remains that, despite testing, a bug may still slip through. In 
addition, every manager realizes that elements beyond the agency’s control will remain. For example, a 
temporary power shortage, bad data from a data exchange partner, or the inability of a vendor to 
provide key supplies could disrupt work at an agency. Many of these scenarios could happen - and 
have happened - independently of the Y2K problem. An essential requirement for sound management 
of the year 2000 problem is to plan and prepare for the unknown effects of Y2K as well as for issues 
that are beyond the control of the agency. 

We have directed agencies to use the General Accounting Office’s (GAO) guidance on this 
subject in preparing their plans. Additionally, many agencies are working closely with their Inspectors 
General and/or expert contractors in the development of these plans. While it is expected that BCCPs 
will continue to change through the end of the year as agencies update and refine their assumptions and 
as they continue to test and modify systems^ we have asked agencies to submit their initial BCCPs to us 
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no later than June 1 5. We will work with the agencies to assure government wide consistency of their 
basic assumptions surroimding the year 2000 problem. 

As you know, over the last few years, 0MB, in partnership with the Congress and the 
agencies, has worked hard to ensure that the Federal Government has adequate resources to address 
the Y2K challenge. The President's fiscal year 1999 budget requested approximately SI. 1 billion in 
appropriations for y2K, and also included an allowance of $3.25 billion to cover emerging and 
potential costs for Bosnia, natural disasters, and Y2K. In September 1998, consistent with Senate 
action to that point, the Administration formally requested an emergency supplemental appropriation of 
$3.23 billion for Y2K. The Omnibus Consolidated and Emergency Supplemental Appropriations Act 
for fiscal year 1999 (P.L. 105-277) included contingent emergency funding for Y2K computer 
conversion activities: $2,25 billion for non-defense srtivities and $1.1 billion for defense-related 
activities. P.L. 105-277 makes the Director ofthe Office ofManagement and Budget responsible for 
allocating non-defense funding, and the Secretary of Defense responsible for allocating defense-related 
funds. 


In order to determine how to best allocate all available non-defense funding for Y2K - both 
base appropriations and emergency funding — 0MB has worked with agencies to evaluate Y2K 
requirements. First, OMB .made certain that agencies received funding for activities that were 
requested in the President's fiscal year 1999 Budget, but that Congress directed be funded from the 
Y2K contingent emergency reserve. These activities totaled approximately $590 million. 

Then, to determine which requirements should be addressed with emergency funding, OMB 
has reviewed agency requests on an as-needed basis and made recommendations regarding which 
activities were to be funded at a given time. To date, OMB has approved the release of $1.2 billion in 
emergency funding for unforeseen Y2K-related requirements. In total, $1.8 billion has been allocated 
in six separate emergency releases, with $14 million being returned to the emergency fund pursuant to a 
Congressional request. Therefore, $505 million remains available for non-defense agencies to address 
emerging requirements. The Department of Defense has allocated $935 million of the $ 1 . 1 billion made 
available for defense-related activities, and $135 million (15 percent) remains in reserve for contingent 
needs. 


Additional transfers from the contingent emergency reserve will be made as needs are identified 
to ensure that all agencies have sufficient resources to achieve Y2K compliance, complete contingency 
planning, and execute those plans where necessary. OMB has notified agencies that, as they identify 
unforeseen funding requirements, they should forward these requirements to OMB for evaluation. 

The most recent allocation ofY2K emergency funding, transmitted on April 2, 1999, provides 
a total of $199 million to 20 Federal agencies. Fourteen of these agencies have received emergency 
funding in earlier allocations. Funds will be used for various Y2K compliance activities, including testing 
to ensure that systems are Y2K compliant, replacement of embedded computer chips, creation and 
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verification of continuity of operations and contingency plans, and cooperative activities with non- 
Federal entities in support of the President’s Council on Year 2000 Conversion. 

Agencies have benefited greatly from access to emergency funds, and much of their progress 
can be credited to this. Continued access to emergency funding is essential to continued progress on 
the Y2K problem. However, the Senate version of the FY 1999 Emergency Supplemental 
Appropriations Bill would reduce the non-defense Y2K emergency fund by $973 million. I urge the 
conferees to strike this reduction, which is unwise at this time. Not only would it eliminate the remaining 
balance in the emergency fund, but it would also force agencies to stop planned and ongoing 
procurements for Y2K-related activities. It would also force agencies to terminate contracts, where 
this can be done without penalty, in order to rec^ture the remaining $468 million. 

In sum, resources must remain available for agencies to carry out aggressive strategies to 
achieve compliance and to develop and implement contingency plans that will ensure uninterrupted 
operations and service delivery. In recent months, the pace towards achieving government wide 
compliance has quickened considerably. Much of this improvement can be attributed to the emergency 
fund, which has ensured that adequate resources remain available to agencies as they develop and 
refine effective strategies for achieving full Y2K compliance. With the year 2000 approaching, we 
should be building on our success, not taking steps that could undermine it. 

In conclusion, during the 262 days remaining before the year 2000, we plan to: 

• Complete work on remaining mission critical systems and on other Federal systems. 

• Conduct end-to-end testing with the States and other key partners, placing special emphasis on 
ensuring the readiness of programs that have a direct and immediate impact on public health, 
safety, and well-being. 

• Complete and test business continuity and contingency plans as insurance against any 
disruptions related to Y2K failures. 

Thank you for the opportunity to allow me to share information with you on the 
Administration’s progress. 0MB remains committed to working with the Committee and Congress on 
this critical issue. I would be pleased to answer any questions you may have. 
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Mrs. Morella. Thank you, Ms. Lee. We let you exceed the dead- 
line because you had so many milestones and dates to tell us 
about, we felt were very important. 

It is a pleasure now to recognize Mr. Willemssen from GAO. 

Mr. Willemssen. Thank you. Chairwoman Morella, Chairman 
Horn, Ranking Member Barcia, Ranking Member Turner. Thank 
you for inviting GAO to testify today on the status of government- 
wide Y2K. As requested, I will briefly summarize our statement. 

As noted, the Federal Government’s most recent reports showed 
continued improvement in addressing Y2K. Despite this progress, 
however, there are vital government functions with systems that 
are not yet compliant. Additionally, not all of the government sys- 
tems have undergone independent verification and validation. 

In addition, achieving compliance of individual systems, while 
very important, does not necessarily ensure that a key business 
function will continue to operate through the change of the century. 
Other key actions are essential to achieving this goal. For example, 
as noted earlier, end-to-end testing is extremely important. That is 
needed to verify that a set of interrelated systems supporting an 
overall function will work seamlessly and work together as we 
move to the next century. 

In addition, business continuity and contingency plans are essen- 
tial. In this regard, 0MB has previously asked Federal agencies to 
identify their core business functions that are to be addressed in 
their business continuity and contingency plans, as well as to pro- 
vide key milestones for the development and testing of such plans. 

To ensure that key activities, such as end-to-end testing and con- 
tingency planning, are fully addressed for the most important Gov- 
ernment programs, we have previously recommended to the execu- 
tive branch that the Government set Y2K priorities. 

In late March, 0MB implemented our recommendation by 
issuing a memorandum to Federal agencies identifying 42 high-im- 
pact programs. For each program, a lead agency was designated to 
take a leadership role in convening program partners in developing 
a plan to ensure that the program will operate effectively. Two 
days from now, lead agencies are to provide to 0MB a schedule and 
milestones of the key planned activities for these high-impact prior- 
ities. The quality and completeness of these plans will be a major 
factor in the success of this effort and in assuring the public that 
Y2K will be addressed for the most critical government functions. 

About one-quarter of these high-impact programs identified by 
0MB are State-administered programs, such as food stamps and 
Medicaid. As we previously testified, several of these programs, 
such as Medicaid, are at risk. Recent data from 0MB on State-ad- 
ministered systems shows that there is a continuing reason for con- 
cern and a need for Federal/State partnerships. Specifically, there 
is a large number of State systems reported not to be due to be 
compliant until the last half of 1999. 

One agency that has worked for some time on Y2K with its State 
partners is the Social Security administration. Since our report in 
late 1997, SSA has strengthened its approach with States on dis- 
ability determination services. It designated a full-time team with 
project managers and requested biweekly status reports, and ob- 
tained from each State a plan specifying milestones, resources, and 
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schedules for completing Y2K tasks. SSA’s activities in this area 
can serve as a model for other Federal agencies as they go forward 
with their State-administered programs and their State partners. 

In summary, it is clear that the Federal Government has made 
excellent progress on Y2K over the last couple of years. However, 
much more remains to be done to ensure the continued delivery of 
vital services. That concludes a summary of my statement. At the 
end of the panel, I will be pleased to address any questions you 
may have. Thank you. 

[The prepared statement of Mr. Willemssen follows:] 
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Mr. Chairman, Ms. Chairwoman, and Members of the Subcommittees: 

I am pleased to appear today to discuss progress being made in addressing the Year 2000 computing 
challenge and to outline actions needed to ensure a smooth conversion to the next century. The 
federal govemment-with its widespread dependence on large-scale, complex computer systems to 
deliver vital public services and carry out its massive operations-faces an especially enormous and 
difficult task. Unless adequately confronted. Year 2000 computing problems could lead to serious 
disruptions in key federal operations, ranging from national defense to benefits payments to air 
traffic management. 

Consequently, in February 1997, GAO designated the Year 2000 computing problem as a high-risk 
area. Our purpose was to stimulate greater attention to assessing the government's exposure to Year 
2000 risks and to strengthen planning for achieving Year 2000 compliance for mission-critical 
systems. Fortunately, the past 2 years have witnessed marked improvement in preparedness as the 
government has revised and intensified its approach to this problem. 

Today 1 will discuss the status of the federal government’s remediation of its mission-critical 
systems. In addition, I will lay out some of the remaining challenges facing the government in 
ensuring the continuity of business operations, namely end-to-end testing and business continuity and 
contingency planning, and the Office of Management and Budget’s (OMB’s) efforts to identify the 
government’s high impact programs. Lastly, I will discuss the readiness of state systems that are 
essential to the delivery of federal human services programs. 
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IMPROVEMENTS MADE BtJT 
MUCH WORK REMAINS 


Addressing the Year 2000 problem is a tremendous challenge for the federal government. To meet 
this challenge and monitor individual agency efforts, OMB directed the major departments and 
agencies to submit quarterly reports on their progress, beginning May 15, 1997. These reports 
contain information on where agencies stand with respect to the assessment, renovation, validation, 
and implementation of mission-critical systems, as well as other management information on items 
such as business continuity and contingency plans and costs. 

The federal government's most recent reports show improvement in addressing the Year 2000 
problem. While much work remains, the federal government has significantly increased the 
percentage of mission-critical systems that are reported to be Year 2000 compliant, as chart 1 
illustrates. In particular, while the federal government did not meet its goal of having all mission- 
critical systems compliant by March 1999, 92 percent of these systems were reported to have met 
this goal. 
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Chart 1: Missiort-Critiral Systems Reported Year 2000 Compliant, May 1997-March 1999 

Percent 


100% 



10% 

0% I I I- N II—I I I ii—lll— II 

Mays? Alto'S? Nov-97 Fab-SS May-99 Aug-Sfi Nov-SS Fab-99 Maf-99 

Source: May 1997 - February 1999 data are from the 0MB quarterly reports. The March 1999 data 
are from the President’s Council on Year 2000 Conversion and OMB. 

While this progress is notable, 1 1 agencies did not meet OMB’s deadline for all of their mission- 
ciiticai systems.’ Some of the systems that were not yet compliant support vital government 
functions. For example, many of the Federal Aviation Administration’s (FAA) systems were not 
compliant as of the March deadline. As we testified last month, several of these systems provide 


‘The 1 1 agencies were the Departments of Agriculture, Commerce, Defense, Energy, Health and 
Human Services, Justice, State, Transportation, Treasury; the National Aeronautics and Space 
Administration; and the U.S. Agency for International Development. 
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critical functions, ranging from communications to radar processing to weather surveillance.^ 

Among other systems that did not meet the March 1999 deadline are those operated by Health Care 
Financing Administration (HCFA) contractors. As we testified in February 1999, these systems are 
critical to processing Medicare claims.’ 

Additionally, not all systems have undergone an independent verification and validation process. 

For example, the Environmental Protection Agency and the Department of the Interior reponed that 
57 and 3 of its systems, respectively, deemed compliant were still undergoing independent 
verification and validation. 

In some cases, independent verification and validation of compliant systems have found serious 
problems. For example, as we testified before you this February,* none of HCFA’s 54 external 
mission-critical systems reported by the Department of Health and Human Services as compliant as 
of December 31, 1998, was Year 2000 ready, based on serious qualifications identified by the 
independent verification and validation contractor. Other examples have been cited in agency 
quarterly reports; 

• In February 1999, the Department of Commerce reclassified a system from compliant to 

noncompliant because an independent verification and validation contractor had concerns about 
some of the commercial-off-the-shelf software used in the system and wanted to review 

^ Year 2000 Computing Crisis: FAA Is Makine Progress But Important Challenges Remain (GAO/T- 
AIMD/RCED-99-118, March 15, 1999). 

^ Year 2000 Computing Crisis: Medicare and the Delivery of Health Services Are at Risk (GAO/T- 
AIMD-99-89, February 24, 1999) and Year 2000 Computing Crisis: Readiness Status of the 
penartment of Health and Human Services (GAO/r-AIMD-99-92, February 26, 1999). 
‘^GAOyT-AIMD-99-92, February 26, 1999. 
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additional test data. 

• In Febraary 1999 the Environmental Protection Agency reponed that its independent third party 
review process found a Year 2000 error in a system that was later repaired, tested, and returned to 
production. 

• In November 1998, the Department of Health and Human Services reported that it removed four 
Indian Health Service systems from compliant status because an independent verification and 
validation contractor found that their data exchanges were not compliant. 

MUCH WORK REMAINS TO ENSURE 
CONTINUITY OF FEDERAL OPERATIONS 

Achieving individual system compliance, although important, does not necessarily ensure that a 
business function will continue to operate through the change of century— the ultimate goal of Year 
2000 efforts. Key actions, such as end-to-end testing and business continuity and contingency 
planning, are vital to ensuring that this goal is met. Further, OMB has recently taken action on our 
April 1998 recommendation to set govemmentwide priorities and has identified the government’s 
high-impact programs.' This is an excellent step toward ensuring the continuing delivery of vital 
services. 

End-To-End Testing 

To ensure that their mission-critical systems can reliably exchange data with other systems and that 


^GAO/AIMD-98-85, April 30, 1998. 
5 





27 


they are protected from errors that can be introduced by external systems, agencies must perform 
end-to-end testing of their critical core business processes. The putpose of end-to-end testing is to . 
verify that a defined set of interrelated systems, which collectively support an organizational core 
business area or function, will work as intended in an operational environment. In the case of the 
year 2000, many systems in the end-to-end chain will have been modified or replaced. As a result, 
the scope and complexity of testing-and its importance-are dramatically increased, as is the 
difficulty of isolating, identifying, and correcting problems. Consequently, agencies must work early 
and continually with their data exchange partners to plan and execute effective end-to-end tests (our 
Year 2000 testing guide sets forth a structured approach to testing, including end-to-end testing).* 

In January 1999 we testified that with the time available for end-to-end testing diminishing, 0MB 
should consider, for the government’s most critical functions, setting target dates, and having 
agencies report against them, for the development of end-to-end test plans, the establishment of test 
schedules, and the completion of the tests.’ On March 31, OMB and the Chair of the President’s 
Council on Year 2000 Conversion announced that one of the key priorities that federal agencies will 
be pursuing during the rest of 1999 will be cooperative efforts regarding end-to-end testing to 
demonstrate the Year 2000 readiness of federal programs with states and other panners critical to the 
administration of those programs. 

We are also encouraged by some agencies’ recent actions. For example, we testified this March, that 

*Year 2000 Computing Crisis: A Testing Guide (GAO/AIMD-10. 1.21. November 1998). 

’ Year 2000 Computing Crisis: Readiness Improving. But Much Work Remains to Avoid Major 
Disraptions (GAOfr-AIMD-99-50, January 20, 1999). 
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the Department of Defense’s Principal Staff Assistants are planning to conduct end-to-end tests to 
ensure that systems that collectively support core business areas can interoperate as intended in a 
Year 2000 environment.® Further, our March 1999 testimony’ found that FAA had addressed our 
prior concerns with the lack of detail in its draft end-to-end test program plan and had developed a 
detailed end-to-end testing strategy and plans.'® 

Business Continuity and Contingency Plans 


Business continuity and contingency plans are essential. Without such plans, when unpredicted 
failures occur, agencies will not have well-defined responses and may not have enough time to 
develop and test alternatives. Federal agencies depend on data provided by their business partners as 
well as on services provided by the public infrastructure {e.g., power, water, transportation, and voice 
and data telecommunications). One weak link anywhere in the chain of critical dependencies can 
cause major disruptions to business operations. Given these interdependencies, it is imperative that 
contingency plans be developed for all critical core business processes and supporting systems, 
regardless of whether these systems are owned by the agency. Accordingly, in April 1998, we 
recommended that the Council require agencies to develop contingency plans for all critical core 
business processes.’' 


^ Year 2000 Computing Crisis: Defense Has Made Progress. But Additional Management Controls 
Are Needed (GAO/T-AIMD-99-101, March 2, 1999). 

^GAO/T-AIMD/RCED-99- 118, March 15, 1999. 

' °FAA Systems: Serious Challenges Remain in Resolving Year 2000 and Computer Security 
R-oblems (GAO/T-AIMD-98-251, August 6, 1998). 

" Year 2000 Computing Crisis: Potential for Widespread Disruption Call for Strong Leadership and 
Partemships (GAO/AIMD-98-85, April 30, 1998). 
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OMB has clarified its contingency plan instractions and, along with the CIO Council, has adopted 
our business continuity and contingency planning guide. In particular, on January 26, 1999, OMB 
called on federal agencies to identify and report on the high-level core business functions that are to 
be addressed in their business continuity and contingency plans as well as to provide key milestones 
for development and testing of business continuity and contingency plans in their February 1999 
quarterly reports. Accordingly, in their February 1999 reports, almost all agencies listed their high- 
level core business functions. Indeed, major departments and agencies listed over 400 core business 
functions. For example, the Department of Veterans Affairs classified its core business functions 
into two critical areas: benefits delivery (six business lines supported this area) and health care. 

Our review of the 24 major departments and agencies February 1999 quarterly reports found that 
business continuity and contingency planning was generally well underway. However, we also 
found cases in which agencies: (1) were in the early stages of business continuity and contingency 
planning, (2) did not indicate when they planned to complete and/or test their plan, (3) did not intend 
to complete their plans until after April 1999, or (4) did not intend to finish testing the plans until 
after September 1999. In January 1999, we testified before you that OMB could consider setting a 
target date, such as April 30, 1999, for the completion of business continuity and contingency plans, 
and require agencies to report on their progress against this milestone.'^ This would encourage 
agencies to expeditiously develop and finalize their plans and would provide the President’s Council 

‘^ Year 2000 Computing Crisis: Business Continuity and Contingency Planning (GAO/AIMD- 
10.1.19, August 1998). 

‘^GAO/T-AIMD-99-50, January 20, 1999. 
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on Year 2CKK) Conversion and OMB with more complete information on agencies’ status on this 
critical issue. To provide assurance that agencies’ business continuity and contingency plans will 
work if they are needed, we aiso suggested that OMB may want to consider requiring agencies to tesl 
their business continuity strategy and set a target date, such as September 30, 1999, for the 
completion of this validation. 

On March 31, OMB and the Chair of the President’s Council on Year 2000 Conversion announced 
that completing and testing business continuity and contingency plans as insurance against 
disruptions to federal service delivery and operations from Year 2000-related failures will be one of 
the key priorities that federal agencies will be pursuing through the rest of 1999. OMB also 
announced that it planned to ask agencies to submit their business continuity and contingency plans 
in June. In addition to this action, we would encourage OMB to implement the suggestion that we 
made in our January 20 testimony and establish a target date for the validation of these business 
continuity and contingency plans. 

Recent OMB Action Could Help Ensure 
Business Continuity of High-Imoact Programs 

While individual agencies have been identifying and remediating mission-critical systems, the 
government’s future actions need to be focused on its high priority programs and ensuring the 
continuity of these programs, including the continuity of federal programs that are administered by 
states. Accordingly, govemmentwide priorities need to be based on such criteria as the potential for 
adverse health and safety effects, adverse financial effects on American citizens, detrimental effects 
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on national security, and adverse economic consequences. In April 1998 we recommended that the 
President’s Council on Year 2000 Conversion establish govemmentwide priorities and ensure that 
agencies set agencywide priorities.’^ 

On March 26, 1999, 0MB implemented our recommendation by issuing a memorandum to federal 
agencies designating lead agencies for the government’s 42 high-impact programs (e.g., food stamps. 
Medicare, and federal electric power generation and delivery); appendix I lists these programs and 
lead agencies. For each program, the lead agency was charged with identifying to 0MB, the partners 
integral to program delivery; taking a leadership role in convening those partners; assuring that each 
partner has an adequate Year 2000 plan and, if not, helping each partner without one; and developing 
a plan to ensure that the program will operate effectively. According to OMB, such a plan might 
include testing data exchanges across partners, developing complementary business continuity and 
contingency plans, sharing key information on readiness with other partners and the public, and 
taking other steps necessary to ensure that the program will work. OMB directed the lead agencies 
to provide a schedule and milestones of key activities in the plan by April 15. OMB also asked 
agencies to provide monthly progress reports. 


STATES’ SYSTEMS’ READINESS ESSENTIAL TO THE 
DET^IVERY OF FEDERAL HUMAN SERVICES PROGRAMS 

OMB’s March 1999 memorandum identifies several high-impact state-administered programs, such 
as Food Stamps, Medicaid, and Temporary Assistance for Needy Families, in which both the federal 

'‘‘GAO/AIMD-98-85, April 30. 1998. 
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government and the states have a huge vested interest, both financial and social. Reports by us and 
the federal lead agencies have indicated the need for the lead federal agency to work together with 
the states to ensure that programs vital to so many individuals can continue through the change of 
century. 

As we reported in November 1998, many systems that support such human services programs were 
at risk and much work remained to ensure continued services.'* In February 1999, we testified that 
while some progress had been achieved, many states’ systems have been reported to be at risk and 
were not scheduled to become compliant until the last half of 1999.'* Further, progress reports had 
been based largely on state self-reporting which, upon site visits, has occasionally been found to be 
overly optimistic. Accordingly, we concluded that, given these risks, business continuity and 
contingency planning was even more important in ensuring continuity of program operations and 
benefits in the event of systems failures. 

In January 1999 0MB implemented a requirement that federal oversight agencies include the status 
of selected state human services systems in their quarterly reports. Specifically, 0MB requested that 
the agencies describe actions to help ensure that federally supported, state-run programs will be able 
to provide services and benefits. 0MB further asked that agencies report the date when each state’s 
systems will be Year 2000-compliant. Table 1 summarizes the information gathered by the 
Departments of Agriculture, Health and Human Services, and Labor on how many state-level 

'* Year 2000 Computing Crisis: Readiness of State Automated Systems to Sunnort Federal 'Welfare 
Programs (GAO/AIMD-99-28, November 6, 1998). 

"’ Year 2000 Comnuting Crisis: Readiness of State Automated Systems That Support Federal 
Human Services Programs (GAOn'-AIMD-99-91, February 24, 1999). 
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organizations are compliant or when in 1999 they planned to be compliant. 


Table 1: Reported State -level Readiness for Key Federally Supported Programs^ 


Program 

Compliant 

Januaiy- 

Maich 

April- 

June 

July- 

September 

October- 

December 

No 

Report 

Food Stamps 

15 

10 

12 

8 

5 

0 

Unemployment Insurance 

21 

6 

13 

8 

1 

1 

Temporary Assistance for 
Needy Families 

7 

3 

12 

4 

2 

22 

Medicaid - Integrated 
Eligibility System 

3 

I 

8 

5 

1 

33 

Medicaid - Management 
Information Systems 

7 

7 

14 

12 

2 

9 

Child Support 

4 

6 

10 

3 

2 

25 

Child Care 

4 

3 

8 

5 

2 

31 

Child Welfare 

6 

3 

hhb 

5 

2 

27 

Women, Infants, and 
Children 

24 

8 

6 

6 

6 

0 


^According to 0MB, the Departments of Agriculture and Health and Human Services were still 
collecting information from the states on the status of the Child Nutrition Program and the Low 
Income Home Energy Assistance Program, respectively. 


Source: Progress on Year 2000 Conversion. (OMB, data received February 12, 1999, issued on 
March 18, 1999). 

Note: OMB reported the status of 5 programs for 50 state-level organizations (Food Stamps, 
Unemployment Insurance, Temporary Assistance for Needy Families. Child Support, and Women, 
Infants, and Children). The status of 3 programs was provided for 51 state-level organizations 
(Medicaid and Child Welfare). The status of Child Care was provided for 53 state-level 
organizations. 


This table illustrates the need for federai/state partnerships to ensure the continuity of these vital 
services, since a considerable number of state-level organizations are not due to be compliant until 
the ;ast half of 1999, and the agencies have not received reports from many states. Such partnerships 
could include* the coordination of federal and state business continuity and contingency plans for 
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human resources programs. 

One agency that could serve as a model to other federal agencies in working with state partners is the 
Social Security Administration, which relies on states to help process claims under its disability 
insurance program. In October 1997, we made recommendations to the Social Security 
Administration to improve its monitoring and oversight of state disability determination services and 
to develop contingency plans that consider the disability claims processing functions within state 
disability determination services systems." The Social Security Administration agreed with these 
recommendations and, as we testified this Febraary, has taken several actions." For example, it 
established a full-time disability determination services project team, designating project managers 
and coordinators, and requesting biweekly status reports. The agency also obtained from each state 
disability determination service (1) a plan specifying the specific milestones, resources, and 
schedules for completing Year 2000 conversion tasks, and (2) contingency plans. Such an approach 
could be valuable to other federal agencies in helping ensure the continued delivery of services. 

In addition to the state systems that support federal programs, another important aspect of the federal 
government’s Year 2000 efforts with the states are data exchanges. For example, the Social Security 
Administration exchanges data files with the states to determine the eligibility of disabled persons 
for disability payments and the National Highway Traffic Safety Administration provides states with 
information needed for drivers registration. As part of addressing this issue, the General Services 

^ Social Security Administration: Significant Prouress Made in Year 2000 Effort. But Key Risks 
Remain (GAO/AIMD-98-6, October 22, 1997). 

‘" Year 2000 Computing Crisis: Update on the Readiness of the Social Security Administration 
(GAO/T-AIMD-99-90, February 24, 1999). 
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Administration is collecting information from federal agencies and the states on the status of their 
exchanges through a secured Internet World Wide Web site. According to an official at the General 
Services Administration, 70 percent of federal/state data exchanges are Year 2000 compliant. 
However, this official would not provide us with supporting documentation for this statement nor 
would they allow us access to their database. Accordingly, we could not verify the status of 
federal/state data exchanges. 


In conclusion, it is clear that much progress has been made in addressing the Year 2000 challenge. It 
is equally clear, however, that much additional work remains to ensure the continued delivery of 
vital services. The federal government and its partners must work diligently and cooperatively so 
that such services are not disrupted. 

Mr. Chairman, Ms. Chairwoman, this concludes my statement. I will be pleased to respond to any 
questions that you or other members of the Subcommittees may have at this time. 
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APPENDIX I 


APPENDIX I 


Federal High-Imoact Programs and Lead Agencies 


Agency 

Program 

Department of Agricuiture 

Child Nutrition Programs 

Department of Agricuiture 

Food Safety Inspection 

Department of Agriculture 

Food Stamps 

Department of Agriculture 

Special Supplemental Nutrition Program for Women, 

Infants, and Children 

Department of Commerce 

Patent and trademark processing 

Department of Commerce 

Weather Service 

Department of Defense 

Military Hospitals 

Department of Defense 

Military Retirement 

Department of Education 

Student Aid 

Department of Energy 

Federal electric power generation and delivery 

Department of Health and Human 
Services 

Child Care 

Department of Health and Human 
Services 

Child Support Enforcement 

Department of Health and Human 
Services 

Child Welfare 

Department of Health and Human 
Services 

Disease monitoring and the ability to issue warnings 

Department of Health and Human 
Services 

Indian Health Service 

Department of Health and Human 
Services 

Low Income Home Energy Assistance Program 

Department of Health and Human 
Services 

Medicaid 

Department of Health and Human 
Services 

Medicare 

Department of Health and Human 
Services 

Organ Transplants 

Department of Health and Human 
Services 

Temporary Assistance for Needy Families 

Department of Housing and Urban 
Development 

Housing loans (Government National Mortgage 

Association) 
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Department of Housing and Urban 
Development 

Section 8 Rental Assistance 

Department of Housing and Urban 
Development 

Public Housing 

Department of Housing and Urban 
Development 

FHA Mortgage Insurance 

Department of Housing and Urban 
Development 

Community Development Block Grants 

Department of the Interior 

Bureau of Indians Affairs programs 

Department of Justice 

Federal Prisons 

Department of Justice 

Immigration 

Department of Labor 

Unemployment Insurance 

Department of State 

Passport Applications and Processing 

Department of Transportation 

Air Traffic Control system 

Department of Transportation 

Maritime Search and Rescue 

Department of the Treasury 

Cross-border Mspection Services 


Veterans’ Benefits 

Department of Veterans Affairs 

Veterans’ Health Care 

Federal Emergency Management 
Agency 

Disaster Relief 

Office of Personnel Management 

Federal Employee Health Benefits 

Office of Pereonnel Management 

Federal Employee Life Insurance 

Office of Personnel Management 

Federal Employee Retirement Benefits 

Railroad Retirement Board 

Retired Rail Workers Benefits 

Social Security Administration 

Social Security Benefits 

U.S. Postal Service 

Mail Service 


(511750) 
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Mrs. Morella. Now, I am pleased to recognize Ms. Reed from 
the Department of Agriculture. 

Ms. Reed. Thank you, Chairwoman Morella, Chairman Horn, 
Ranking Member Barcia. I appreciate this opportunity to share 
with you where the Department of Agriculture stands with respect 
to Y2K. 

We are committed to assuring that our programs will be viable 
after January 1st. We recognize our responsibility for food safety 
and inspection, food and nutrition programs, rural economic devel- 
opment, natural resources and conservation, research and edu- 
cation, and, of course, programs which support America’s farmers. 

USDA is currently tracking 350 mission-critical systems; 93 per- 
cent of these systems are compliant and fully deployed. We have 
an additional number of systems where the remediation work has 
been done, but eight of them have yet to achieve full deployment; 
ten systems are still undergoing remediation or replacement; and 
five are anticipated to be retired. 

Secretary Glickman has identified 52 of our systems as depart- 
mental priority systems because the programs that they support 
have major health and safety implications, financial impact, or eco- 
nomic repercussions. 

Our priorities are to achieve 100 percent compliance and imple- 
mentation of all critical mission-critical and non-mission-critical 
systems, conduct the end-to-end testing, coordinating with the 
States, banks, and other Federal agencies as appropriate, continue 
to perform independent validation and verification on our priority 
systems, finalize our business continuity and contingency plans, 
and continue to assess Y2K impacts on the food supply. 

0MB has identified four USDA programs on its list of 40 high- 
impact Federal programs. They include three nutrition programs; 
the food stamp program, women and infant children program, and 
child nutrition programs. 

The fourth is food safety and inspection. Food and nutrition pro- 
grams are vital to the availability of food for millions of Americans, 
especially those who are neediest. The Food and Nutrition Service, 
FNS, has been working diligently to remediate its own mission-crit- 
ical systems that support these programs. Fourteen are fully com- 
pliant; the final two will be compliant by the end of this month. 
FNS has performed testing on its communication links between the 
State systems and our internal systems. Testing to this point has 
been successful. 

We are working with State partners and territories who actually 
deliver the services to the public. Since June 1997, USDA and 
other Federal departments have jointly established expedited ap- 
proval procedures for State acquisition of ADP resources necessary 
to support their Y2K efforts. We believe that most of the States are 
using their own resources for this, since only two have actually cho- 
sen to use our expedited approval. 

FNS is also tracking each State’s progress. They must certify to 
us that they are compliant in hardware, software, and tele- 
communications. They must also share with us their business con- 
tinuity and contingency plans. 

The Food Safety Inspection Service regulates a vital part of our 
food supply: meat, poultry, and eggs products. Twenty-six States 
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have programs which complement the FSIS health program. With- 
in FSIS, our Food Safety and Inspection Service, seven of eight 
mission-critical systems are now compliant and fully deployed. The 
remaining one should be done by the end of this summer. We have 
an overall business continuity contingency plan and are working 
very closely with the States and with the plants to assure that they 
are aware of what needs to be done to support Y2K. 

In addition to these programs, there are other programs that the 
Department is treating as high impact, because of their economic, 
financial, and health and safety impact. These include farm loan 
and assistance programs; and rural development programs; animal, 
plant and health inspection programs; fire management program; 
and the Federal employee payroll system and Thrift Savings Plan. 
To date, 47 of the systems which support these mission-critical pri- 
ority programs are compliant and fully deployed; five systems re- 
main to be completed and should be completed no later than July. 

USDA also chairs the Food Supply Working Group of the Presi- 
dent’s Council on Year 2000 Conversion. I will just share with you 
that we do not anticipate any major disruptions to the food supply, 
but will continue to work and report on this area, as we will con- 
tinue to support outreach to our small businesses. We have a major 
outreach program that we have undertaken in cooperation with the 
Department of Commerce and the Small Business Administration. 

In conclusion, all of our work is designed to ensure that USDA’s 
critical programs are available to the American public without dis- 
ruption, and we have a lot of work left to do, but we believe that 
we are up to this challenge. 

Thank you. 

[The prepared statement of Ms. Reed follows:] 
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April 13, 1:00pm 

OfTice of the Chief Tnfonniition Orficci- - USDA 
Anne F. Thomson Reed 

Joint Hearing of the Subcommittee on Government Management, 

Information and Technology, and the Subcommittee on Technology 
April 13, 1999 

Mr. Chairman, and Madam Chairwoman, thank you for inviting me to discuss the 
Department of Agriculture's (USDA) Year 2000 compliance efforts. With your permission, I will 
submit my written testimony for the record and make a few brief comments. 

I appreciate the opportunity to discuss with you tiie Department's progress thus far and 
our planned next steps to ensure that our core business functions operate seamlessly on January 1, 
2000. The programs that USDA delivers daily affect the lives of every American, as well as 
millions of people all over the world. 

• We have a major responsibility for food safety - and one of President Clinton’s and 
Secretary Glickman’s primary initiatives is to continue to improve our inspection 
system for meat and poultry, from the farm-lo-table. 

• Through the food stamp program, the Women, Infants and Childrens (WIC) 
Program, the school lunch and other child nutrition programs, we prttvide food 
assistance to millions of Americans each and every day. 

• Our rural development programs help small businesses to create jobs; help house 
rural families; and bring electric, telephone, and water and waste systems - the 
infrastructure backbone throughout much of rural America - througli tliousands of 
rural communities. 
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• USDA, through the Forest Service, manages more acres of recreational land than 
any other entity, and wc light the fires that pen'odically threaten that land. 

• Our mission includes programs to conserve our soil, programs to protect our water 
and plants from pollution, and programs to protect our animals from disease. Our 
natural resource programs help protect nearly 75 percent of the nation's land. 

• USDA supports research, through our own laboratories as well as through the land 
grant university system, to develop new technologies that improve the 
productivity and competitiveness of our farmers, and our economists and 
statisticians monitor virtually every aspect of the farm and food economy. 

• The Department's mission is also to expand domestic and overseas markets for 
U.S. agricultural products through promoting exports while reducing trade barriers 
and helping farmers manage risk. We combat hunger around the world through otir 
programs, providing millions of tons of food aid each year, and wo are a key 
partner helping to bring aid to tlie Balkan refugees. 

• In addition to these core missions, USDA, through our National Finance Center in 
New Orleans, is also directly responsible for processing the pay checks and 
retirement accounts of over 400,000 Federal employees. Our National 
Information Technology Center in Kansas City provides Information Technology 
(IT) services to the Federal Aviation Administration (FAA) and other agencies. 

Needless to say, all of these programs depend heavily on computer systems and microchip 
technology to deliver USDA’s $67 billion in programs. 

As you requested, I will update you on our current status, and discuss what we are doing 
to ensure uninterrupted delivery of the “lugh-impact" programs recommended by the Office of 
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Management and Budget (0MB), In addition, I want to diseuss some programs we are also 
treating as high priority because of how critical they are to the public, especially rural America. 
Lastly, I will update you briefly on our outreach to small businesses and the work we are doing 
with the President's Council on Year 2000 Conversion, especially as it relates to the effect of Y2K 
on the food supply. 


Current Status of USDA's Mission-Critical Systems 

USDA is currently tracking 350 mission-critical systems. At present, 335 systems, or 96 
percent, are fully compliant, Bight of the 335 systems are compliant, but not yet fully deployed. 
Two of these systems are scheduled for deployment later this month and two more are scheduled 
for deployment in May. Three are scheduled for deployment in August, and one for September. 
We have 1 5 systems that are not yet compliant - including ten systems that are yet to be renovated 
or replaced, and five scheduled to be retired. 

Secretary Glickman has also identified 52 of our mission critical systems as 
“Departmental-priority" because the programs they support have major health and safety 
implications, financial effects or economic repercussions. I will discuss some of these systems and 
the programs they support in a moment. Our priorities are to: 

• achieve 1 00 percent compliance and implementation of all mission-critical and non- 
mission critical systems; 

• conduct end- to-end testing, coordinating with slates, banks, and other federal 
agencies as appropriate; 

• perform Independent Validation and Verification (IV&V’s) on all Departmental 
priority systems and selected mission critical systems; 
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• finalize Agency Business Continuity and Contingency Plans (BCCPs) and; 

• continue to assess the Y2K effects on the food supply, rural utilities, food and 
nutrition programs, farm programs, and our trading partners - focusing on 
contingency planning. 

Next Steps; Achieve 100 percent complinncefTesting/ 1V&V/ BCCP 

My office is tracking on a daily basis the 1 5 remaining mission-critical systems which are 
not yet compliant on a daily basis. Agencies have provided me time-lines for compliance, 
implementation, and deployment and I plan to continue updating the Secretary and sub-cabinet 
officials weekly until we have achieved 100 percent compliance. 1 have attached charts which will 
provide the Committees with additional details about the status of each of these systems. 
(Altachmeiil) 

We plan to conduct extensive end-to-end testing to do all we can to mitigate Year 2000 
risks to our programs. We have observed closely the experience of others which makes it clear 
that extensive testing on compliant systems and their interfaces with other systems is absolutely 
necessary. Our policy is to work with state and industry data exchange partners to ensure 
program and service delivery for all priority programs. For example, the National Finance Center 
has worked with its partners at T reasury and the Federal Reserve to test data exchanges to 
ensure 450,000 Federal employees be paid without iniemiption. 

On March 31, USDA’s Inspector General released a report addressing reviews conducted 
between March 1998 and Januaiy 1999 on the various phases of USDA's Year 2000 conversion 
program. The report addressed issues related to the accuracy of reporting, the need for stronger 
project management and cost reporting, and for more guidance related to conlingoncy planning. 
The report noted that we have taken prompt action on the IG’s recommendations and achieved 
closure on five of seven findings. The final two findings address vulnerable systems and 
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telecommunications, and testing and certification ofcomplianee. We are taking action to address 
those findings. The IG’s findings have been veiy helpful to use in ensuring that we have a very 
robust Year 2000 program. 

I am also taking steps to centralize and strengthen our management of the IV&V process. 
We are also requiring outside IV&V for all Departmental priority systems. 

One example is the IV&V which was conducted on the Direct Loan Origination System 
(DLOS), which supports key rural lending programs. DLOS is a commercial software package 
that supports our single family housing and grant portfolio. An outside contractor performed the 
IV&V, and delivered modified software which was installed for testing. Testing was performed 
by Rural Development personnel, problems were documented, and the contractor made the 
necessary modifications. Test plans identified all of the processes and data exchanges, as well as 
the organizations responsible for the testing. 

Wo are also finalizing the Department’s Business Continuity and Contingency Plans 
(BCCPs), which focus on our core business processes. Our Departmental level plan incorporates 
plans from each agency and mission area, as well as USDA slaiT offices. Final agency plans are 
due to my office on June IS. They arc establisliing Business Resumption Teams and have 
submitted a schedule to test their BCCPs to my office. Agencies arc also in the process of 
developing their day one strategies. 

FOOD AND NUTRITION 

The Office of Management and Budget has identified four USDA programs on its list of 
40 “high-impact" Federal programs. Let me share with you where we arc with each of these 
programs, before talking about others we believe have a high impact as well. The food and 
nutrition programs on OMB’s '‘high-impact” list, which arc delivered in partnership with the 
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states, are vital to the availability of food for millions of Americans, especially those who are 
neediest. They are the food stamp program, child nutrition programs, and the WIC program. 

The Food and Nutrition Service (FNS) has been working diligently to remediate the 
mission critical systems that support these nutrition programs. With respect to FNS’s own 
internal mission-critical systems, fourteen are tiilly compliant and two more will be compliant at 
the end of April. 

FNS has performed Y2K testing on its communication links between the state systems and 
FNS’s internal systems. Testing to this point has been successful and no problems have been 
encountered. FNS is continuing to test these interfitccs between the agency, stales, and other 
partners. States must certify to FNS that they are Year 2000 compliant in three areas - software, 
hardware, and telecommunications. Depending upon their status, stales must certify in writing 
that they have a working contingency plan in place that will assure the delivery of benefits to FSP 
and WIC recipients, 

FNS is working with its state partners and territories who actually deliver nutrition 
services to the public. Since June of 1 997 USDA and other Departments have jointly established 
expedited approval procedures for state acquisition of automatic data processing equipment and 
services required to bring food stamp program administrative systems into Year 2000 compliance. 
It also allows states to use expedited procedures for contingency planning. This authority has 
been extended through July 2000. To our knowledge, only two states have taken advantage of 
this expedited approval process. FNS believes that most states are accounting for Y2K correction 
activities as part of their on-going administrative operating and maintenance expenditures, and so 
are claiming administrative expenses as part of their regular programmatic federal administrative 
funding for Food Stamps, WIC, and child nutrition programs. 

As of March, twenty one states have reported that their food stamp systems are compliant 
in all respects; seven of those slates have already sent letters to FNS cenifying that they are Ycru- 


6 



46 


2000 compliant. Seventeen additional stales have reported that they will be compliant between 
April and June. Eleven states have reported that they will be compliant between July and 
September, and five states have reported that they will be compliant between October and 
December. All states are reporting that they will be compliant by December 31,1 909. 

Thirty one states have reported that their WIC systems are Year 2000 compliant. FNS has 
received certification letters from fifteen of those stales, Twelve additional states have reported 
that they will be compliant between April and June. Nine states have reported that they will be 
compliant belw^n July and September. Two stales have reported that they will be compliant 
between October and December. All states are reporting that their WIC systems will be Year 
2000 compliant by December 31, 1999. 

Thirty four of the 67 state agencies that administer child nutrition programs have reported 
that they arc flilly Y2K compliant. Most of the rest expect to achieve compliance in all areas by 
the end of the summer. FNS will continue to monitor those states that have not achieved and 
reported full compliance. FNS’s regional offices are also working with state agencies to ascertain 
the viability of state contingency plans. 

FNS is in the final stages of awarding a contract to provide Y2K technical support to the 
states who did not report plans to be compliant in March. FNS will also follow up with on site 
visits to selected, with reviews prioritised based on out most recent slate reported compliance 
dates. 

FOOD SAFETY 

The Food Safety and Inspection Service (FSIS) regulates a vital part of America’s food 
supply-moat, poultry, and egg products. Anericans depend on FSIS to ensure that these 
products are safe, wholesome, and accurately labeled. Twenty-six states have programs which 
complement FSIS’s public health program. 
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FSIS continues to provide information to individual plants, aiorting them to their 
responsibilities to be ready for the Y2K transition. The agency is sharing its plans, proces.ses, and 
experiences with the state directors who have inspection responsibilities, will determine the Y2K 
readiness of its state partners, as part of its readiness activities, and wilt work with States to 
ensure that their programs operate eflectively. 

FSIS has also prepared an overall Y2K Business Continuity (Contingency) Plan (BCCP) 
for its internal systems to ensure that food safety standards are maintained during the milienium 
transition. Tlie plan contains specific contingencies for the resumption of operations in the event 
of systems failure. 


USDA’S DEPARTMENTAL PRIORITY PROGRAMS 


In addition to these programs, there are other programs that the Department is treating as 
high impact because of their economic, financial, and health and safety impact. These include: 

• the farm loan and assistance programs and rural development programs; 

• animal and plant health inspection programs; 

• the fire manageinenl program; and 

• the Federal Employee Payroll system and Thrift Savings Plan. 

These programs are vital to the economic well-being or the health and safety of millions of 
Americans. They are especially critical to rural America. There are 52 mission-critical systems 
most of which support these programs. To date, 47 of them are compliant and fully deployed. 
Five of the systems remain to be completed. These remaining systems should be fitlly deployed by 
June. 


FEDERAL EMPLOYEE PAYROLL SYSTEM/ THRIFT SAVINGS PLAN 
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The Federal Employee Payroll System, and the Thrift Savings Plan are managed by the 
National Finance Center (NFC) in Now Orleans. Tlic NFC processes payroll bi-weekly for 
450,000 Federal employees and manages retirement savings for 2,3 million Federal employees. 

All mission-critical programs at the NFC are compliant and have been validated on a 
separate mainframe running with system and internal dates into the year 2000, All Information 
Technology (IT) hardware and system software has been validated using the same technique. All 
non IT equipment as well as the facility have been certified Y2K compliant by internal or external 
IV&Vs and vendor certifications. 

In addition, in case of a local power failure, the NFC has secured auxiliary diesel 
generators with enough capacity and fiiel to power the entire facility for an extended period of 
time, A contingency plan is in place to also deal with any telecommunication or system failure 
that might occur. Wo are confident that any power outages can be effectively dealt with and that 
these programs can be delivered without interruption. 

FARM LOAN AND RURAL DEVELOPMENT PROGRAMS 

Farm loan and crop loss disaster assistance programs, along with programs to provide 
funds for lural business and infrastructure, are critical to our nation’s farmers and producers, and 
the rural economy. These programs are core business functions which we cannot afford to have 
interrupted. 

The Guaranteed Loan System (GLS) tracks loans made by private lenders, but guaranteed 
by the Government. This system has been a joint development effort by the Farm Service Agency 
and Rural Development and was developed to be Ycitr 2000 compliant. Implementation of GLS 
was conducted in phases starting in May 1998, For servicing direct loans, the Program Loan 
Accounting System (PLAS) was renovated to be Year 2000 compliant and implemented during 
March 1999. Contractor-suppoitcd IV&Vs of the Program Loan Accounting System was 


9 



49 


initiated in March 1999. Crop Loss Disaster Assistance Program software that is Year 2000 
compliant has also been developed. 

The Farm Service Agency's Business Continuity Plan details who, how, when, and what is 
necessary to ensure mission operations in the event of a Year 2000 failure, including 
documentation of any manual processes. T csting of the FS A Business Resumption Contingency 
Plans is targeted for June 1999. 

The Rural Development BCCP is also being refined to detail the manual processes which 
will be used in the event of a system failure. These processes arc scheduled to be tested in third 
quarter of this year. Testing is also being planned with external entities. 

USDA is also giving careful attention to the Y2K readiness of rural utility providers. In 
February 1998 the Rural Utilities Service (RUS) started surveying its telecommunications and 
electric borrowers to determine their level of Year 2000 preparedness. RUS’s field 
representatives are making personal visits and telephone contacts with all electric and 
telecommunications borrowers who have not indicated when they plan to become compliant to 
detemtine their status and offer assistance. These utilities are also being monitored by the utilities 
industry and the Energy Working Group headed by the Department of Energy. 

ANIMAL AND PLANT INSPECTION PROGRAMS 

Animal and plant inspection programs are not well known outside of the agricultural 
community, but arc nevertheless vital to ensuring the health and safety of our livestock, and plant 
life, which translates into the health and safety of us ail. Eiglitecn of the mission-critical systems 
which support these programs are already Year 2000 compliant. The remaining three systems are 
scheduled to be compliant by June 30. 

The Animal Plant Health and Inspection Service is working closely with its state partners 
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to test and certify electronic data exchanges for the National Agriculture Pest Information System 
(NAPIS). Thus far, cloven states have certified that they are compliant, and nine have undergone 
testing. The agency has also participated in Business Continuity and Contingency Planning 
meetings with the Canadian Food Inspection Agency and the Air Transport Association, which 
represents major airlines and airports across the counliy. 

FOREST FIRE MANAGEMENT 

The Forest Service’s Fire &Aviation Management System has health and safety, as well as 
financid effects. An IV&V on this system is in progress, and scheduled for completion in June. 
Also, all data exchanges with external partners and cooperators have been identified and assured 
to have Y2K compliant formats which arc being tested by the FS and external partners. 

The Forest Service has also developed its BCCP, and is selecting a contractor to support 
testing of the plan with emphasis on mitigation strategics. Program management support is also 
being assembled to follow up on the implementation programs of work committed to by FS staff 
and units in the BCCP. The FS is also forming Business Resumption Teams. 

roOD SUPPLY WORKING GROUP 

Mr. Chairman, Madam Chairwoman, before responding to your questions, 1 also want to 
mention briefly the work we are doing with the President’s Council on Year 2000 Conversion and 
other outreach activities, especially to lural America. 

As you may know USUA chairs the Food Supply Working Group (I'SWG) of the 
President's council. The Department is also represented on several other working groups, 
including benefits payments, building operations, consumer affairs, education, emergency services, 
energy (electric power), environmental protection, health care, finance, housing, human services, 
international trade, telecommunications, and transportation. 
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The Food Supply Working Group, co-chaircd by the Under Secretaries for Food Safety, 
Farm and Foreign Agricultural Service, and Marketing and Regulatory Programs, has been 
working with several food industry associations to assess the Y2K readiness of the food supply. 
Tlie working group recently submitted its second report to the President's council. The report 
notes that the state of readiness of the food industry remains encouraging. The American public 
can be confident that the major domestic companies, which provide most of the key foods, will 
continue to operate in spite of the Year 2000 problem. Any interruption in the food supply so 
severe as to threaten the well-being and basic comfort of the American public is very unlikely. 

We are also working with the President's council to plan a “food industry roundtable" in 
late May or early June. The roundtable will be designed to bring together key members of the 
food industry - who represent different sectors of the farm-to-table food supply chain - to further 
deepen our understanding of the food industry's preparedness, as well as develop an overall 
message to the public about Y2K and the food supply. 

INTERNATIONAL EFFECTS 


The Department also has major interests in Y2IC in the intentational arena, and wo are 
actively working with the President's council to assess the likely Y2K effects on US agricultural 
trade. Attaches of the Department's Foreign Agricultural Service (FAS) continue to gather 
information from foreign government ofiicials, industiy associations, and private companies on 
Year 2000 preparations in 81 countries which account for roughly 97 percent of U.S. food 
imports and 95 percent of U.S. exports during the first quarter of the calender year. 

OUTREACH TO SMALL IIUSINESSES 

We arc also continuing our outreach to rural areas and small businesses, many of whom 
rely on USOA loan and grant programs. 
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On April 1, 1999. USDA conducted a nationwide satellite broadcast in conjunction with 
Small Business Y2K Action Week. The interactive video-conference, which was viewed at 1 S3 
sites in 40 states across the country, was designed to increase awareness among small business 
owners and local governments concerning the tlireat Y2K poses to their operations, provide 
technical assistance, and inform them of resources available at USDA and other agencies to help 
them with solutions. The Cooperative State Research Education and Extension Service is 
planning to rebroadcast the conference, and several of our Held locations have requested tapes for 
future viewing. 

USDA is also very active in providing direct technical assistance to small business owners. 
Tltrough the Cooperative State Research Education and Extension Service (CSREES), we have 
entered into a partnership with the Small Business Administration and the Manufacturing 
Extension Partnership to provide technical assistance to small businesses. CSREES is providing 
assistance through a series of Y2K workshops, as well as ‘jumpstarf ' kits, which includes a 
CD-ROM and other tools, to help business owners inventoiy and assess systems that may be 
vulnerable to Year 2000 problems. 

CONCLUSION 

Our outreach elTorts, our close work with state and local partners, our extensive business 
continuity and contingency planning, our extensive testing and other efforts are designed 
ultimately to ensure that USDA's critical programs arc available to the American public without 
interruption despite the Year 2000 problem. We still have a tremendous amount of work to do on 
all fronts. I do believe, however, that we have made significant progress, and that we will bo 
ready when the time comes. 

I look forward to working together and closely with the Congress, the Office of 
Management and Budget, the GAO, USDA's agencies, as well as the public as we work to meet 
this challenge. I will respond to any questions you have at this time. 
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Notes 

FSIS sd>edule for complelttn. As previously reported, the Agency 
will achieve full deployment by September 30, 1999. FSIS will 
continue to upgrade Escharge/Outlook as new patches become 
available from Microsoft, which is the deslgnef of the software, 
the migration to Exchange is already complete in HeatlQuartets 
and most of the field offices. The Agency will use the flK 
sup[*niental budget that was not available uniU January 1999 to 
facilitate future field deotoymenl In the remainmo fi«d offices. 

iSplP 

pill ill 

. * i E * S S 

i 1 1 ? 1 1 1 

f 1 bll.i'a 

saliSil 

JislalS 

1 

llfi. 

flli! 

iljii 

Im 

filii 

I issli 

illli 

itiliilii 

ij i (! 
liifllli 

ilsPilP 

^£3 Sz 

fmm 

iiiiirii 

ti 1^1! 

- i sf tlil 
III 1 

•S i 1 s S 1 5 
S;S2S|is2 
* p’ag R 

Six modules erf this system have been remediated, three are fully 
deerfoved and three wiil complete deployment by April 26, 1999. 

Application is instalied on compliant servers; fot;ms and reports will 
be completed by 3/31/99; field tests m early April; fix bugs in late 
Aoril: imbtement In May and June 1999. 

1 

i 

I 

1 

1 

{ 

1 1 
1 i 




1 


1 1 

1 S" 

i 1 



1 


1 

\ 

- 



1 

§ 

S 

1 

1 

Is 

V 


1 

1 

5 

- 





ii 

" 







1 iljlil 

• iiii 

|12 

Iff 

Pf 

ijl 

t|| - 1 

nm 

illill 

1 

1 

1 

i-Bf _| 

^llfl 

mv 

ii 

*ft|l 
■ pi'ii 

II 

' III?! 

lllll 

t 

e "a 

« n g 1 £ 5 

ml 

1 llllIl 

1 

Ii 

if 

i| 

31 

.JJ 

III 

Hh 

11 

sill 

1 1 

l 1 

1 2 

1 1,1 

|| 

I ill 



1 

1 li 

1 

i 

1 

1 

I 

Ii 

1 

1 


1 

6 e 

£ 

; i 

1 . 
i 

I 



55 


Notes 

Basic system to support Veterinary Diagnostics will be In place on 
compnant server In Ames, lA by 3/31/99. ARS reports telecomm 
will be ready at Plum Island by 6/1/99. 

All but 1 SNOTEL module win be Impiemented by COB 3/31/99. 
TbeDMP module wd not be deployed at this tune, itrsa 
completely rtew module and the rigorous testing Is taking longer 
than expeaed. Prelected dare is Atxtl 16, 1999. 

inere are aiiveMV i j peKwiarcamiiuiBK uat a/e m aitipiaw. 

New computers have been ordered and we are awaiting shipment. 
The new systems will be Installed upon receipt. The vendor 
antlopates delivery to CSREES areund 4/16/99 All installations 
should be completed bv April 30. 1999 
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Mrs. Morella. Thank you, Ms. Reed. 

We have heen joined by Mr. Miller from California; by Mrs. 
Biggert from Illinois; and now we recognize Mr. Nygard. 

Mr. Nygard. Thank you, Madam Chairwoman. Madam Chair- 
man, members of the subcommittee 

Mrs. Morella. Excuse me, Mr. Nygard. We are going to have a 
vote coming up, but I think we will have a chance to hear your tes- 
timony and then go vote. We will recess for about 15 minutes and 
then come back, and pick up then with the Department of State. 

Thank you. 

Mr. Nygard. Should I proceed? 

Mrs. Morella. We want to make sure — we never feel com- 
fortable or secure around here with those buzzers. They succeed — 
OK, great. You may proceed. [Laughter.] 

Mr. Nygard. Thank you. Madam Chairwoman. Madam Chair- 
woman, Chairman Horn, members of the subcommittee, I am 
pleased to appear today to report on the progress of the U.S. Agen- 
cy for International Development, or USAID, in achieving Y2K sys- 
tems compliance. In short, we at USAID are confident that our 
mission-critical systems will be Y2K compliant well before the end 
of this year, and that our agency will operate successfully on and 
after January 1st of next year. 

Let me talk, first, about our mission-critical systems. As you are 
aware, we did not achieve Y2K compliance for these systems by the 
end of March, the governmentwide target date. Until early Feb- 
ruary, we had expected that three of the five systems that need to 
be repaired would be implemented by March 31st, but problems 
discovered during the testing phase delayed our efforts and forced 
us to move back our completion dates. These delays in all three 
systems were the result of problems encountered outside the sys- 
tems themselves and were caught as we tested the broader proc- 
esses that the systems support. 

Our time and attendance systems, for example, rely on the gov- 
ernment-wide International Cable System to transmit data back to 
Washington from our field posts. A program which extracts data 
from the cable system needed to be repaired to be Y2K compliant. 
The problem with the other two systems, personnel and payroll, re- 
sulted from an interface or linkage between the two systems whose 
code was not Y2K compliant. Once discovered, these problems were 
quickly fixed. All three systems are back in testing, and we plan 
for them to be fully implemented by May 15th. 

Before turning to our other mission-critical systems, let me clar- 
ify what USAID defines as “implementing its Y2K-compliant sys- 
tems.” A system is implemented, in our view, when it is up and 
fully running, both at our headquarters and our overseas posts. 
This means our testing must include not only the systems them- 
selves, but any connections to other systems or processes, such as 
that to the cable system mentioned above, that are needed for the 
mission-critical system to operate. It also means that our field 
posts, which we call missions, must have received and put into op- 
eration any necessary hardware and software needed to run the re- 
paired systems. 

This point is relevant to our fourth mission-critical systems, over- 
seas accounting. This system is renovated and field testing at two 
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overseas post will commence next week. The required software and 
equipment have been sent to our 40 accounting stations overseas, 
and we expect implementation to he complete worldwide by the end 
of May. The main risk for this system is logistical rather than tech- 
nical. The possibility always exists that equipment being sent over- 
seas may be lost or stolen in transit. We are taking all possible pre- 
cautions in this regard, including having our overseas staff pick up 
the equipment at airports immediately when it arrives in the coun- 
try. 

Our fifth critical system is USAID’s new management system, 
which performs accounting, budgeting, and procurement functions 
at our Washington headquarters. The complexity of this system 
means that substantial work is needed to renovate it. We have uti- 
lized funding from the government-wide Y2K supplemental to 
apply additional programming and other resources to the task, and 
believe it will be renovated by the end of this month and fully test- 
ed and implemented by the end of July. 

Our efforts have been greatly assisted by the methods of program 
management and measurement used by our prime contractor. Each 
step is laid out carefully and progress toward implementation of 
each system is quantified in terms of points for value earned to 
date. This approach has given us a high level of confidence that all 
of our mission-critical systems will be up and running, Y2K compli- 
ant worldwide, within the next few months, because we now know 
precisely what has been done and what needs to be done. 

Let me next mention the steps we are taking to assure that our 
agency will be able to carry out essential business functions if auto- 
mated information systems are unable to operate for reasons be- 
yond our control. Since last fall, our Chief Financial Officer staff 
has been working to develop contingency plans that will assure the 
continuity of business operations for three basic processes: funds 
distribution, obligation of funds, and payments. All are broad cat- 
egories and involve multiple applications. 

Payments, for example, includes providing funding to vendors 
and grantees who deliver goods and services to USAID, but also in- 
cludes meeting the agency payroll. I am pleased to report that 
these contingency plans, whose preparation is being assisted by a 
highly qualified contractor, are well along and will be field tested 
and finalized during the summer. 

A final point I want to discuss is the ability of our field missions 
overseas to continue operating and providing assistance to the 
countries in which they are located. We have sent teams from 
Washington to 50 of our overseas posts to examine each mission’s 
operating systems, the information technology used in its assist- 
ance programs, and in many cases the host country infrastructure 
upon which our missions depend to operate. We are working closely 
with the Department of State and other agencies who operate over- 
seas to assure that essential functions will continue next January. 

As we get closer to January 1, 2000, more information will be 
generated about the situation in the countries where we work, and 
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we will have a much better idea of the extent to which our ability 
to operate will be affected. This matter is of great concern to us, 
and we will continue to watch it closely country by country. 

That completes my statement. Thank you very much. 

[The prepared statement of Mr. Nygard follows:] 
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I am pleased to represent Administrator Atwood at today’s hearing. USAID has been listed 
among the highest risk federal Agencies for Y2K. While USAID usually focuses on risks others 
face such as support for Hurricane Mitch reconstruction and humanitarian response in Kosovo, I 
want to assure you we understand the significance of resolving the Y2K problem, so that the 
Agency can carry out its important fimctions without interruption. 

The U.S. Agency for International Development (USAID) administers bilateral economic 
assistance programs as an important instrument of U.S. foreign policy. The Agency has more 
than 7,000 employees worldwide, with 2,000 p^sonnel at headquarters in Washington, DC. 
USAID’s field structure is made up of 79 overseas missions and donor coordination sites in 
Latin America and the Caribbean, Aftica, Asia, the Near East, Europe and the New Independent 
States of the former Soviet Union. Information systems support the business processes of the 
Agency’s operations at headquarters and at our overseas posts. 

We have determined that seven of our information systems are “mission critical” with regard to 
Y2K compliance. Two of these are currently being discontinued or outsourced. The other five 
are being made Y2K compliant. They are: personnel, time and attendance, payroll, overseas 
accounting and the New Management Systems (NMS). The largest and most complex of these 
applications is NMS, which supports headquarters financial management, acquisition & 
assistance, budget and operations. 

USAID has been working actively to repair and test the mission critical systems to ensure Y2K 
compliance. In February 1998, a USAID-commissioned study carried out by the General 
Services Administration, with team members from IBM and Coopers & Lybrand, advised us that 
USAID lacked the size and expertise as an Agency fo serve as its own system integrator for its 
business systems. Previously the Agency had used multiple contractors for developing and 
running the computer capabilities for corporate operations but supervised each of ^ese 
specialized companies on an individual basis. 

Based on the findings of this independent assessment, USAID obtained a prime contractor 
(Computer Sciences Corporation) in June 1998 to support its future information technology 
efforts worldwide, including Year 2000 improvements. Study findings also advocated that 
USAID should implement specific technical management strategies to minimize risk, because 
time was so short before the Millennium change and the federal Y2K deadline of March 31, 
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1999. These practices included detailed measurement of Y2K progress and comprehensive 
testing. 

USAID has held itself to the highest standards on Y2K compliance because of the significance of 
sustaining support for our program operations. We will claim successful implementation of our 
mission critical systems only when the Y2K compliant versions are fully installed and operating 
at both headquarters and overseas locations and relevant testing on all related components has 
been accomplished. 

While the Agency has missed the March 31, 1999 target date for implementing Y2K mission 
critical systems, we have made great progress toward completing this task. After 10 months of 
the Agency Y2K program supported by its prime contractor, USAID has renovated four of the 
five mission critical systems; Personnel, Time & Attendance, Payroll and Field Accounting. 

We intend to continue the rigorous discipline of measuring and testing on our mission critical 
Y2K effort. Our measurement techniques have enabled us to track accurately the progress on 
fixing each date sensitive component of each system. Knowing where the problems are provides 
us a higher level of confidence that these systems will be ready well in advance of the 
Millennium change. The comprehensive testing has brought problems into the open, as intended, 
and has permitted early correction. 

We have focused specific attention on testing of our older systems and fixing date problems in 
NMS. The discovery of imexpected problems in the validation or testing phase caused schedule 
delays in 3 of the 5 systems in February, one of which had been previously designated asY2K 
compliant. In all three cases, the problems were outside the systems themselves but involved 
linkages that would have prevented Y2K compliant implementation. 

USAID experience matches the advice of OMB and industry that testing is the essential core of 
Y2K activity. 

The specific circumstances that affectjd USAID’s Y2K program in February were identified in 
our last quarterly report to OMB: 

Programmers discovered software logic in a data interface program outside our mission critical 
Payroll and Personnel systems that was not only at Y2K risk but in the wrong place. This forced 
a change in the Personnel system to set matters right on an application we previously 
implemented for Y2K compliance. Both Payroll and Personnel systems were renovated 
successfully in February, and were returned for additional Y2K testing in parallel. 

The Time & Attendance system for our missions has been renovated. However an interface to 
the Time & Attendance system, called the USAID Cable Switching System, was found to require 
Y2K improvement for comprehensive testing of this function. This interface reads and translates 
time and attendance data received from missions by diplomatic cable into a format that our 
mainframe payroll system can process. The cable switching system’s Y2K repair has been 
expedited so USAID can meet the strictest definition of compliance for the Time & Attendance 
system including all of its essential interfaces. 
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Four missions have received Y2K compliant software Time & Attendance software for the “end 
to end” testing. Y2K compliant computers have been installed in all USAID missions, so when 
these pilot sites finish their testing the Agency will complete implementation with updated 
software. 

Similar rigorous testing guidelines are being applied to USAID’s field accounting application, 
which must be installed with data conversion at 40 overseas missions. Y2K compliant 
equipment has been shipped and field accounting software tests begin at two pilot sites on April 

26 . 

I am pleased to report that our personal computers, networks and satellite capabilities essential 
for Agency mission critical systems are compliant. Some field posts, however, require additional 
equipment, which is currently being shipped. 

There is always risk in sending equipment overseas that some items will be lost or stolen during 
shipment. We are working with missions to assure that as many deliveries as possible will be 
picked up by our Mission staffs as they are unloaded fixim the airplanes. 

If testing and implementation goes forward as planned, three of our five mission critical systems 
(Personnel, Time & Attendance and Payroll) will be implemented by the middle of May. The 
field accounting system is scheduled for implementation at the end of May, and we expect some 
missions to beat that deadline. 

NMS is targeted for validation and implementation in July. Progress against the planned Y2K 
schedule for NMS remains the most significant Agency concern. The NMS application has 
stabilized with sustained attention from our technical staff and the prime contractor, but software 
error rates identified in last year’s GSA review are a factor in accomplishing Y2K changes. The 
next most challenging Y2K task is completion of validation for the payroll program by May 15 
because of its significant size. 

The summary of USAID Y2K progress and projected milestone completion dates is shown in 
the following table: 
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USAID Y2K Progress by GAO Category and Mission Criticai System 



Total Mission 
Critical 
Systems 

Assessment 

Renovation 

Validation 

Implementation 

All to be 
completed by 

1 Total 

30 Nov 1998 

30 Apr 1999 

01 Jul 1999 

30 Jul 1999 

Number 
completed by 
31 Mar 1999 

5 Repaired 

2 Replaced 

5of5 

4 of 5 

2 of 5 

0 of 5 

Percent of Repaired Systems 

Now Completed 

100% 

80% 

40% 

Schedule Date 

Personnel 


RAMPS 

yDone 

30 Apr 1999 

15 May 1999 

Payroll 


NAPS 

^Done 


15 May 1999 

Time & Attendance 

AETA 

y^Done 

yDone 


Field Accounting 

MACS 

✓Done 

yOone 

30 May 1999 

Admin 


NMS 

InW81E3a 

Jul 1999 



USAID efforts to ensure that these systems will be made compliant are underway. When 
Agency efforts on mission critical systems ran into difficulty in February, the Administrator and 
I met with the president of our prime contractor to discuss corrective action. 

Findings of the prime contractor’s analysis pointed to the importance of integrating the schedules 
of USAID’s Y2K projects to highlight the interdependencies important for complete testing. We 
are augmenting our methods of measuring progress to assure technical problems in critical 
interfaces are recorded for action and tracking. Additional time is also being spent on quality 
assurance activities to correct errors in Y2K program effort as early as possible. 

USAID business continuity planning is occurring at two levels: internal and external. Internal 
Agency Y2K business continuity planning for mission critical systems focuses on three critical 
functions: payments, obligations and funds management. The business continuity and 
contingency planning program, addresses the capability to handle, at an essential and minimal 
acceptable level, these critical functions through any Y2K difficulty. 

Y2K contingency plans began last fall with an analysis of business processes and assets followed 
by a prioritization of these processes/activities. This initiative included a series of workshops to 
validate the financial management core processes interrelated with funds control, payments and 
obligation functions. Business processes were validated and decomposed to sub-process and 
major activity levels. Data has been collected, risk dependencies determined, asset Y2K 
readiness assessed and business exposure determined for these functions. The internal “high- 
level” contingency plan was finalized in December 1998. 
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Phase Two, underway since January 1999, formalizes detailed “work arounds” for the business 
processes/activities for each function per the contingency plan such as the manual procedures 
and local spreadsheet applications that would facilitate interim operations. 

Externally, USAID is working with the Department of State Y2K Committees at embassies to 
evaluate on a continuing basis the host nation circumstances arising from Y2K. The potential 
impact of Y2K has been examined for our programs and employees. Contingency strategies such 
as emergency power generation and sustaining telecommunications are under review in 
coordination with the State Department. 

USAID does not require any legislative action to optimize Y2K preparedness for its mission 
critical programs. We have the necessary resources and are proceeding to assure that 
implementation of Y2K compliant mission critical systems will be completed by July. We do, 
however, remain concerned about the potential impact of Y2K on the developing nations in 
which we work where preparations are just beginning. 
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Mrs. Morella. Thank you very much, Mr. Nygard. 

Sorry for the interruptions. We are going to temporarily recess 
for about 20 minutes, and then we have not only this vote, but then 
another 5-minute vote. So, we are now recessed. 

[Recess.] 

Mrs. Morella. We will reconvene the joint hearing of the two 
subcommittees in the interest of time, and I am going to recognize, 
if he is ready, Mr. Burbano, from the Department of State. 

Mr. Burbano. Thank you. Chairwoman Morella and other distin- 
guished members. 

I plan to provide you with an overview of the Department’s year 
2000 challenge and the status of some of our key year 2000 initia- 
tives. Our discussion today will focus on highlighting several note- 
worthy activities within the Department which will progressively 
ensure State’s core business functions operate seamlessly during, 
and beyond, the millennium crossover. 

Let me begin by saying the Department has maintained year 
2000 as one of its top management priorities. From the Secretary 
down, we are committed to ensuring the Department’s systems and 
operations will run uninterrupted through and beyond the millen- 
nium rollover. I am happy to report that our focus and hard work 
is yielding results. As evidence of our progress, 0MB recently rec- 
ognized the Department’s improved results by raising us from tier 
one, inadequate progress, to tier two, progress. 0MB and GAO also 
cited State for progress in other areas, including modernization in 
computer security, and for our leadership role in providing year 
2000 support to U.S. operations overseas. 

From an organizational perspective, the Department has taken 
many steps to ensure that it has the appropriate management tal- 
ent, structure, and approach in place to successfully manage State’s 
significant year 2000 challenge. Specifically, we have assembled an 
experienced management team to oversee State’s year 2000 pro- 
gram. 

I personally bring previous year 2000 management experience at 
the National Institutes of Health, and I have established a Deputy 
CIO for year 2000 to manage the day-to-day operations of the Year 
2000 Program Management Office. Along with the Deputy CIO for 
year 2000, I have met separately with each of the Assistant Secre- 
taries on a monthly basis to review individual bureau progress to- 
ward remediation, project test results, contingency planning efforts, 
and other year 2000 related activities. Additionally, the Under Sec- 
retary for Management meets monthly with the Assistant Secre- 
taries at a steering committee meeting to manage State’s year 2000 
efforts throughout the Department. 

From a remediation perspective, the Department of State has 
identified 59 systems which support enterprise-wide mission-crit- 
ical functions. Additionally, the Department of State has the 
unique challenge of deploying 32 of its 59, or 54 percent, of its mis- 
sion-critical systems to over 260 posed throughout the world. 

In order to ensure the Department is capable of sustaining our 
core business functions beyond the year 2000, we have established 
a four-phase approach to assess, remediate, verify, and re-verify 
the readiness of our mission-critical systems and support of the De- 
partment’s core business functions. Our four-phase approach in- 
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eludes aggressive global deployment and implementation of our 
most critical technology-based systems and independent certifi- 
cation of our mission-critical applications, a process based on end- 
to-end testing of our core business functions, and, finally, coordi- 
nated business continuation activities which span the year 2000 
boundary. 

First, we believe the Department of State has made significant 
progress in readying its systems for the year 2000 rollover. The De- 
partment has completed the remediation of all 59 mission-critical 
applications, and we are well underway in the implementation of 
our critical and routine systems. Currently, the Department has 
completed implementation of 53 of its 59 mission-critical systems, 
or 90 percent. Ninety-seven percent will be completed by the end 
of April and 100 percent by May 15th. 

Second, the Department of State has established a rigorous year 
2000 compliance certification process, heavily leveraging the expe- 
rience and independence of the Office of the Inspector General. 
Once a mission-critical application has been thoroughly and suc- 
cessfully tested by the bureau, verified and validated by the De- 
partment’s Year 2000 Program Office, my office, along with the De- 
partment’s OIG, conducts an independent review of the project, 
using the best-of-class certification and testing guidelines in order 
to determine the depth and breath of the bureau level of test. If 
necessary, the Department may require the bureau to conduct fur- 
ther testing and revalidation to ensure my office and the OIG are 
confident that the application will not fail in the year 2000. 

The third element of our four-phased approach is to conduct a 
process-based end-to-end test of those Department of State busi- 
ness functions which rely heavily on technology. The A-core func- 
tions which we test at an enterprise level include security, com- 
mand and control, electronic mail, medical, logistics, personnel, fi- 
nancial, and counselor functions. One of the critical success factors 
of our end-to-end test includes our intent to test the suitability and 
viability of the system-level, post-level, and Department-level con- 
tingency plans. In spite of our best efforts, we may have system 
failures in the Department, infrastructure failures in the countries 
where we have U.S. missions, and political or economic dislocations 
which may ultimately impact our ability to perform the business of 
State. 

As such, our forth — and at this point our final — element of our 
multi-phased approach is the development of an integrated and 
overarching business contingency plan. In order to prepare for po- 
tential year 2000 due system or infrastructure failures, the Depart- 
ment of State is finalizing contingency plans to ensure the continu- 
ation of core activities. The Department’s contingency plan and ap- 
proach focuses on maintaining the overall continuation of business 
in the face of year 2000 failures, rather than enabling information 
technology. 

On the international front, the Department of State has devel- 
oped an overseas contingency planning toolkit to allow each of the 
embassies and consulates and missions the ability to develop loca- 
tion-specific contingency plans by balancing the needs and prior- 
ities of the particular post against the year 2000 readiness of that 
host country. While global and deployment and certification of our 
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most critical systems will remain our top near-term priority, the 
Department will continue to aggressively pursue ways to ensure 
the business of State is able to continue beyond the year 2000. 
Thank you. 

[The prepared statement of Mr. Burbano follows:] 
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INTRODUCTION 

The U.S. Department of State has made significant progress in readying its systems for the Year 2000 
rollover. Through effective program management, consistent support and attention from the highest 
management levels in the Department, and a collaborative working arrangement between the Year 2000 
Program Management Office (Y2K PMO) and applications teams, we have and continue to make 
monumental strides in preparing the Department for the Year 2000. 

Currently, the Department has fully implemented 52 of 59 (88%) of its mission critical systems and will 
complete all 59 by the second week in May. This represents a significant accomplishment for the 
Department as many of our most critical technologies (32 of 59 mission critical systems) are being 
deployed worldwide to our 260 embassies, posts, and consulates. Additionally, the Department has 
ne^ly completed all mission critical contingency plans to ensure the business of State will continue 
uninterrupted beyond the Year 2000 if our remediation and verification efforts fall short. 

As part of our verification process, we have developed a comprehensive certification process to ensure the 
Department’s remediation work has been thoroughly tested and documented. The certification process 
will provide an independent verification of each application’s readiness for the Year 2000. We have also 
developed a process-based end-to-end test strategy to test core processes of the Department across 
multiple applications and infrastructure elements. This testing process will further verify the 
Department’s critical processes and technologies are prepared for the millennium date change. 

Finally, we are currently defining a "Day One” strategy and plan to help guide the Department through 
the critical timeframe immediately before, during, and after the millennium rollover. Our “Day One” 
activities will include developing a capability to obtain, consolidate, and disseminate Y2K status 
information from our sites around the world, assisting the Department emergency response center in 
managing any Y2K-induced crises that may arise, and providing guidance on application start-up 
procedures to perform after the millennium rollover. 

Additionally, State has assumed an important role in raising awareness of the Year 2000 problem among 
the international community. We are also working with the President’s Year 2000 Conversion Council 
and co-chalring the International Working Group as part of the Council’s overall Year 2000 Response 
Coordination process. 

Although we have made solid progress on addressing our Year 2000 challenges, there remains work to be 
done. The Department believes by following through on current remediation efforts and conducting the 
verification activities described above, we will be successful in fully preparing the Department for the 
Year 2000. 

In sections I through XII following this introduction, we provide further detail on the state of the 
Department’s readiness and the status of key Y2K initiatives. 
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I. Remediation Progress 

The Department has made substantial progress remediating its 59 Mission Critical applications. Only 7 of 
59 mission critical systems have not been fully implemented. Of the 7 remaining systems, 4 are in the 
process of implementing, and 3 are finishing Y2K testing. These applications are the top priority of the 
Department’s Y2K Program Management Office (PMO) and all are on schedule to be fully implemented 
by May 15, 1999. 

Additional Facts: 

The following table depicts the current status of the Department’s 59 mission critical applications: 

Total Number Compliant/Implemented: 52 of 59 (88%) 

Total Number in process of Implementing: 4 of 59 (7%) 

Total Number in process of Testing/Validation: 3 of 59 (5%) 

Total Number in process of Renovation: 0 of 59 (0%) 

Total Number in process of Assessment: 0 of 59 (0%'\ 

100% 


The remediation strategy for the 59 mission critical applications is as follows: 
Originally Assessed as Compliant: 21 


Retire: 0 

Repair: 14 

Replace: 24 

Total 59 


The Department also maintains 57 Critical applications (26 Originally Compliant, 5 Retire, 25 Repair and 
Replace) and 173 Routine applications (52 Originally Compliant, 20 Retire. 101 Repair and Replace). 


n. Contingency Plans 

Each of the Department’s applications is required to prepare a Year 2000 contingency plan. The purpose 
of the contingency plan is to provide a detailed strategy to ensure the Department’s core business 
processes can continue in the face of Y2K technology failures. Each contingency plan is subject to 
intense technical and operational reviews by the Y2K PMO’s Strike Teams, As well, a viable, 
comprehensive contingency plan is a requirement for Department of State application certification. 

Additional Facts: 

■ The status of Contingency Plans for Mission Critical applications is as follows: 

— 47 of 59 mission critical applications have finalized contingency plans 
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— The Y2K PMO’s Strike Teams are working to finafize the 12 Contingency Plans that are ^ill in 
working form. Al! plans are expected prior to the final implementation date of May 15, 1999. 

■ The Department also requires each overseas post to prepare a Year 2000 Contingency Plan by April 
16, 1999. Each overseas post has been provided with a Contingency Planning Toolkit and training 
to guide them through the process. Please see tte Overseas Business Continuity and Contingency 
Planning section for detailed information on all overseas activities. 


m. Test Plans 

Each of the Department’s applications is required to pr^are a Year 2000 test plan that can produce valid, 
Y2K compliant test results. The purpose of the test plan is to ensure that each application can properly 
function during ^d be;^nd the millennium date. Each application’s test plan is subject to technical and 
operational reviews by the Y2K PMO Strike Teams. Each test plan must include comprehensive testing 
of application functionality across 26 specific dates that may be Y2K sensitive, including January 1, 
February 29, 2000, and the fiscal year end. Any revisions or additions that are required to ensure an 
adequate test plan Is in place must be made before an application can be certified by the Department. 

Die Department is very pissed to confirm that all 59 Mission Critical applications have valid Test Plans 
approved by the Y2K PMO. 


rv. External Data Exchange (Interfaces) 

The Department requires that every application prepare its interfaces (external and internal) through 
remediation and by ensuring that data is exchanged in a mutually agreeable format. The exchange data 
format and parameters are agreed upon via a Memorandum of Understanding (MOU). 

Tl» Department has signed MOUs not only for the data exchange interfaces within the Department, but 
alM) for the data exchanges external to the Department, including agencies such as the FBI and the 
Ifepartment of Defense. Due to our early focus on interfaces and persistence in working with our 
business partners, the Department has successfully finalized al! external and cross-bureau MOUs far its 
mission critical applications. 
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V. Year 2000 Certification 

In September 1998, the Y2K PMO, in coordination with the Department’s Office of Inspector General 
(OIG), finalized and distributed detailed certification guidance for certifying Y2K compliance of our 
mission critical, critical, and routine applications. The certification requirements and process were 
developed to ensure each application has been adequately remediated and tested for year 2000 compliance 
through an independent review of all relevam remediation documentation. Our rigorous certification 
requirements have been validated by the Gartner Group, which commented “from the perspective of 
providing checklists for the approval process, this document is really an excellent one. . . it could indeed be 
considered one of the best quality certification documents we’ve read.” 

The Department believes that solid renovation and testing efforts are only part of the remediation 
equation. By thoroughly reviewing all Y2K-related remediation documentation and processes for each 
application, the Department will have further assurance that its applications will be ready for the Year 


Additional Facts: 

■ All certification packages must ultimately be approved by the Department’s Certification Panel 
chaired by the CIO. 

■ The Y2K PMO has hired and deployed Certification Strike Teams to assist application managers in 
developing certification documentation. 

■ Required certification documentation includes: 

-Y2K Test Plan 

-Contingency Plan 
— Y2K Test Results 
-Configuration Management Plan 

■ Currently, the Department has 32 (54%) of its mission critical applications in the certification 
process and 2 (3%) mission critical applications have been certified. 


VI. Telecommunications 

Four major telecommunications projects are underway at the Depanment. Each provides a systematic 
approach to remediating telecommunications infrastructure to ensure compliance. The following is a 
description of progress for each project. 

^MA (A Logical Modernization Approach^: We have completed installation of our large-scale 
infrastructure modernization program, known as ALMA, in over 84 percent of our overseas missions. 
ALMA is the Department s worldwide standardization of unclassified computers to replace obsolete 
systems and software, including email. When we complete ALMA deployment in June 1999, 229 of our 
overseas missions will have modem, Y2K compliant computer systems in place. 
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Consular Affairs Modernization Project: In order to ^tablish a common Y2K compliant baseline for all 
its infrastructure users, CA is scheduling Y2K “refrc^” visits for consular posts that received the 
modernized consular infrastructure prior to December 1998. These “refresh” visits will provide for 
replacement of non-Y2K compliant hardware, upgrade of commercial off the shelf (COTS) software to 
ALMA specified release levels, and upgrade of consular applications to current release levels. The 
project is now scheduled for completion by June 30, 1999. 

DTS-PO (Diplomatic Telecommunications System Project Office^ Remediation Project DTS-PO has 
identified 66 telecommunications systems items that could be affected by the date change. Each of these 
is being investigated to determine the impact on the DTS network and the 47 customer agencies DTS-PO 
services. Of these 66 items, 64 (97%) are compliant as of April 5, 1999. Remediation of the remaining 
two items is in progress and scheduled to be completed by April 30, 1999. 

NES Project: The National Security Agency has mandated that all NES units must be returned to 
Motorola, Inc. for an upgrade to correct the Universal Changeover/Dual Universal/Dual Edition key 
material issue and perform other minor upgrades. This effort is scheduled for completion by April 30, 
1999. 


Vn. Embedded Systems 

Overseas 

The Department’s assessment of building equipment and components found in overseas facilities revealed 
that facilities established prior to 1982 have no major building systems and equipment that are impacted 
by the Y2K problem. Only 30 overseas facilities exist that have been established from 1982 to the present. 
A check of 28,000 differem items (generators, heating & cooling systems, utilities, etc.) of building 
equipment and components has resulted in the following summary statistics; 


Summary Survey Statistics for 30 Sites 




Initial Number of items in the database: 

28,000 

Number of vendors contacted; 

242 

Number of items reoresented in the Y2K survey: 

4,116 

Number of items considered non-compliant 

3 

Number of Indeterminate Items: 

1.109 

Number items considered Y2K Compliant: 

3,004 

Number / % of DOS locations affected: (of 30 CMPs studied) 

30/100% 

Percent of items considered compliant: 

73% 


Domestic 

The Office of Operations within the Bureau of Administration (A/OPR) has completed an exhaustive 
survey of all the domestic facilities operated by the Department. A total of 23,364 items of building 
infrastructure equipment and components were included, spanning 79 different categories (fire alarm 
systems, elevators, generators, etc.). 
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The results reveal 91% Y2K compliance across all cat^ories. Those categories requiring remediation of 
equipment and component are elevator diagnostics systems, fire alarm panel operating software systems, 
and energy management control systems. Woik on raitediating these systems is in progress. 

The Y2K PMO telecommunications group has prepared embedded systems readiness review packages to 
provide an independent first-hand verification oftte results described above for both overseas and 
domestic sites. These doaiments are designed to capture information directly from sites on the status of 
their building infrastructure systems. 


VIH. Year 2000 Moratoriums 

The Department has issued three Y2K moratoriums to help focus IT resources on fixing Y2K problems 
throughout the Department and ensuring previous remediation activities and Y2K compliant 
environments are not disnirbed until after the millennium rollover. These mandates are described in detail 
below: 

Y.2K Moratorium on Infbrmyion Technology Development . The Under Secretary for Msma^ment 
issued the first Y2K moratorium on non-Y2K related information technology systems development on - 
September 22, 1998. The purpose of the moratorium was to maximize resources, including both 
personnel and funding, to focus on resolving the Year 2000 problem and developing adequate 
contingencies in the event of Y2K-induced failures. To date, this moratorium has been success&I in 
deferring 26 different IT projects across 7 bureaus until after March 1, 2000. The table below indicates 
those projects, by bureau, which have already been deferred under the moratorium. 


Y2K Moratorium 


To date, 26 infomtotion techntdogy projects have been deferred under the Y2K Moratorium. 


Near East SouUs Asian 
Affairs Affair* 


Administration 


tftfbrmalion 

Resources Management 



Consular Affairs 


Finance and Management Foicy 
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Y2K Moratorium on Modifications to Systems and Applications. On March 16, 1999, the Under 
Secretary for Management declared two additional D^rtment-wide moratoriums to limit changes in 
operating systems, including COTS and government off the shelf (GOTS) software, and to applications 
operating in a production environment. These moratoriums will be effective July 1 and September 1, 
1999, respectively. By minimizing changes to operating systems and applications, the Department hopes 
to minimize the risk of failures due to the millennium crossover. 


IX. End-to-End Testing 

The Department has developed a strategy for Year 2000 end-to-end testing of critical transaction flows 
across the major business functions, applications, and infrastructure which supports the transactions. The 
end-to-end test is an important process to ensure core business functions that rely on multiple, inter- 
related mission critical components will continue during and beyond the millenium rollover. 

Our end-to-end test strategy focuses on eight key business processes within the Department, including: 
medical, command and control, personnel, email, consular, security, financial, and logistics. These 
functions comprise the core business areas of the Department and will be tested in a series of logically 
grouped, “clustef ’ te^s of applications and inter-related processes. Our end-to-end testing team is 
currently working with each of the bureaus and application owners to identify cluster management and 
execution teams, devise appropriate, effective test scenarios and define realistic test dates. 

Additioml Facts: 

■ Detailed end-to-end test entrance criteria are currently being established to ensure all components of 
each “cluster” test are Y2K certified. 

■ Test dates will be classified to minimize security risks, 

• We explored the optimal scenario of testing the Department’s business functions simultaneously, 
but this is not feasible . Several constraints and considerations precluding this are: 

-Testing of all business functions at once would involve unmanageable planning, test 
management, and control issues. 

-Command and control and email tests must be conducted as two separate clusters. Both 
require the availability of production environments and one environment must remain 
available for real-time communications. 

■ The five “cluster” tests being prepared include: 

-1) Security/Consular 

—2) Business Management 
—3} Email 

-4) Command and Control 
— 5) Confidence/Retest 
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■ Where possible, the Department will include external agencies and commercial entities in 
the end-to-end testing scenarios. 

■ The Department’s end-to-end test approach will exercise contingency plans. 

■ The end-to-end testing planning phase included direct involvement and oversight by the 
Chief Information Officer (CIO) and the Office of Inspector General (OIG), 


X. Day One Planning 

Based on the current understanding of the Year 2000 problem, it is widely accepted the Department’s 
most critical and vulnerable time frame will likely be the actual rollover from the year 1 999 to the year 
2000. “Day One” is the time period around this rollover date. The Department’s focus to date has 
primarily been on the remediation of all IT systems and the development of contingency plans fer the 
Department’s business processes. With the remediation activities nearing completion, and end-to-end test 
strategies being formulated, the Department’s focus is shifting to development of operational plans for 
this rollover period and other potential problem dates. The purpose of the “Day One” plan is to take a 
proaaive approach and create a logical management framework to coordinate Department operations and 
the resumption of any disrupted services. Additionally, the Department is working to develop a Y2K 
crisis response capability to work in coordination with the Department’s existing emergency response 
center. This additional response capability will likely be necessary to respond to a larger than usual 
volume of calls of varying severity. 


AiMitiomd Facts: 

m An IT operations plan will be developed to designate how each system will perform the crossover to 
minimize the risk of failure and to isolate any problems that do occur, 

— Due to the nature of the Department’s worldwide operations, many systems will remain fully 
operational while others that are not required may be shut down. 

- Other operational systems may have their interfaces to other systems temporarily severed until 
it is determined that outgoing and incoming data is correct. 

— Post-rollover test scenarios will also be developed to ensure that they are operating properly 
prior to putting them into full production in the year 2000. These tests may in part be a subset 
of the end-to-end test scenarios currently in development. 

■ A Department operations plan will also be developed to facilitate the coordination of all Department 
activities during the rollover period. 

- The key to this plan will be the development of a communications strategy and leveraging the 
capabilities of the Department’s current operations center to respond to situations around the 
world. 

- This plan will put in place a mechanism to process a high volume of status and problem 
information from around the world, ensure that Department and US. leadership are kept 
informed, and coordinate response to difficulties. 
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■ The Department has appropriated Hinds to aid busing process owners with the enactment of 
contingency plans and the resumption of normal operations. Many of these resources may take the 
form of Business Resumption Teams that can be deployed as needed to problem areas. 

B Additionally, the Department is investigating what “Day One” activities are being undertaken by 
other government agencies and leading corporations. The Department will incorporate any “best 
practices” discovered into the planning effort to make certain that all reasonable measures are being 
taken to ensure a smooth transition to the Year 2000. 


XL Management and Organization 

As the foreign policy and diplomatic relations arm of the U.S. Government, the Department of State has a 
broad range of Y2K-related responsibilities both domestically and abroad. The Department has been 
working with other agencies to communicate awareness of the Y2K problem to other governments and 
assess each host country’s readiness for the millennium date change, as well as ensuring the Department’s 
own information systems are re^y and viable business process contingencies are in place. The 
Department’s three tiered approach to managing the year 2000 effort mandates a flexible, yet focused 
organization to prepare State for the new millennium. 



•/ International outreach 
/ Country-specific readiness assessments 
/ Awareness 

^ Application remediation activities 
y End-to-end testing of cntical processes 
/ System compliance certification 


✓ Post contingency planning 
toolkit 

✓ ‘Day Zero' planning 

✓ Risk mitigatjon activities 


High priority attention from all management levels, beginning with the Secretary of State, has been 
applied to preparing State for the Year 2000. The Under Secretary for Management has been actively 
Inwlved in supporting, guiding, and managing the Department’s Y2K Program. The Under Secretary 
receives regular updates from the CIO and the Deputy CIO for Y2K on domestic Y2K status, and from 
the Under Secretary’s Senior Advisor on international Y2K issues. Supporting these individuals is a 
robust organization performing the remediation of systems, developing and reviewing certification 
documentation, developing and executing the end-to-end test strategy, and writing “Day One” operational 
plans. 
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Additional Facts: 


m The following organization chart indicates the chain of command employed by the Department to 
manage Y2K efforts. The organization boxes identify the management thread responsible for the 
Department’s Year 2000 preparedness and success. 



■ Each bureau Assistant Secretary is held accountable for remediation progress and overall Y2K 
preparedness within their bureau. Each Assistant Secretary meets with the CIO and Deputy CIO for 
y2K to discuss the status and progress of Y2K in their bureau. These one-on-one meetings precede 
monthly Y2K Steering Committee Meetings with the Under Secretary for Management and each 
Assistant Secretary. The Assistant Secretary-level accountability highlights the Department’s 
emphasis on Y2K readiness. 
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■ At the working level, Y2K efforts sre managed by the DCIO. The DCIO reports status and issues to 
the CIO on a djuly basis through data managed centrally in the Department’s Y2K War Room. The 
War Room acts as the central repository for management information and is the centerpiece of the 
Y2K PMO, conducting a wide range of management oversight, technical validation, and status 
reporting services in support of the Deputy CIO, 

• Internationally, the Senior Advisor works with the PMO and provides outreach to overseas posts. 

He and his staff meet regularly with regional Immu assistant seci^aries to facilitate post readiness 
and contingency planning overseas. The Senior Advisor to the Under Secretary reptKts international 
progress and issues directly to the Under Secretary. 


XXL Overseas Business Continuity and Contingency Planning 

The Department of State has developed a comprehensive business continuity and contingency planning 
strategy for its overseas operations. Among other components, the strategy combines outreach to foreign 
governments, domestic travel advisories, and an overseas contingency planning toolkit for posts to use in 
preparing themselves for the potential impacts of the millenium rollover in their country. This 
compreh^nsiye approach reflects the unique operational circumstances of our overseas activities. 

The Department has leveraged existing post-specific Emergency Action Plans, which are regularly tested, 
and supplemented them with functional and information technology contingency plans to ensure potential 
disruption to the business of the State Department will be minimized. 

AiMtiomI Facts: 

■ 64% of the posts have participated in a toolkit implementation training course to assist posts in 
effectively devising viable post-specific contingency strategies, 

■ A tctol kit help d^k has been established to answer questions and further assist posts while they are 
developing contingency plans. 

■ By April 16, 1999, each Chief of Mission will certify that their embassy and mission have adequate 
contingency plans in place for their post. The contingency plans will address the following criteria: 
-Safety and security of staff and dependents 

“Integrity and security of chancery and other premises 
“Continuity of core mission functions 

■ Bach of the 7 regional bureaus will submit an overarching bureau contingency plan. The regional 
plan will be a comprehensive continuity plan to address continuing the region’s core buriness in the 
face of Y2K-reiated failures. In May 1999, the Regional Assistant Secretaries will briefthe Under 
Secretary for Management on their regional contingency plans. 


■ A final Y2K contingency plan report is expected from each post on September 15, 1999. This 
report wll provide an update on the contingency planning activities since the April certification. 
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■ Through the international outreach program, the Department is communicating with other 
governments to raise awareness and generate intermhional cooperation. The outreach group is 
striving to identify sources of potential breakdowns in critical international business sectors. By 
identifying the sources of potential failure in advance, solutions can be developed to ensure core 
business processes continue. 

■ The Department’s Bureau of Consular Affairs is issuing a series of travel advisories to inform 
citizens on unique regional or country-specific Year 2000 related concsns. The first was issued 
January 26, 1999. As the year 2000 nears, travel advisories will be issued to specifically identify 
countries or regions where travel for American citizens may be dangerous during or because of the 
millennium date change. 
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Mrs. Morella. Thank you very much, Mr. Burbano. 

I wanted to acknowledge that we have here at the hearing Mr. 
Gutknecht from Minnesota and Ms. Jackson-Lee from Texas. 

Mr. Flyzik, from Department of Treasury, we look forward to 
your testimony, sir. 

Mr. Flyzik. Chairwoman Morella, Chairman Horn, members of 
the subcommittee, thank you for the opportunity to appear today 
to discuss the Department of Treasury’s progress on the year 2000 
computer problem. 

As the Deputy Assistant Secretary for Information Systems and 
Chief Information Officer, I am the overall program manager for 
Treasury for this effort. I brief Secretary Rubin periodically and 
provide him a weekly report on our status. The Assistant Secretary 
for Management and CFO and I meet on a recurring basis with all 
bureau heads to review their progress, and, of course, we have 
working groups meeting regularly for information technology, non- 
IT, and telecommunications components of our program. 

Since I testified before Congressman Horn’s subcommittee in 
March of last year. Treasury has made significant progress in en- 
suring our mission-critical systems will operate correctly, and our 
core business processes will function normally on January 1, 2000. 
Treasury has identified a total of 328 mission-critical IT systems; 
9 of these systems are being retired and 293, or 91.8 percent, are 
year 2000 compliant. Eight of our 14 bureaus met the mandate of 
March 31st. Three bureaus are projected to implement 11 of the re- 
maining 26 systems by the end of April, and thereby obtain compli- 
ance. Thirteen of the remaining 15 systems belonging to 3 bu- 
reaus — the Bureau of Alcohol, Tobacco and Firearms, the Financial 
Management Service, and Internal Revenue Service — are expected 
to be implemented by midyear. The last two are new IRS initia- 
tives which are being delayed until after the tax season. 

Three of Treasury’s most visible bureaus — the IRS, Financial 
Management and U.S. Customs — have made tremendous progress 
this past year. IRS is now 90 percent compliant. FMS is able to 
now make 90 percent of its payments, over 775 million annual pay- 
ments, using year 2000 compliant and tested systems. This in- 
cludes monthly Social Security and supplemental security pay- 
ments, veterans’ benefits payments, IRS tax refunds. Railroad Re- 
tirement Board annuity payments. Federal salary payments, and 
vendor payments. The remaining payment systems are on target 
for implementation this month, including the Office of Personnel 
Management Payment System through which FMS issues Federal 
annuity payments. The system is already compliant, but cannot be 
implemented until mid-April due to a dependency on a required 
interface. 

Customs met the goal of achieving year 2000 compliance for its 
mission-critical IT systems by September 1998. In fact, the Cus- 
toms year 2000 program has successfully met program milestones 
established by Treasury, 0MB, and the GAO. The combined audit 
team from General Accounting Office and Treasury and Inspector 
General’s Office found that Customs had established an effective 
year 2000 program control. In addition, the Customs’ year 2000 
program was 1 of 19 Federal programs, out of a field of 200, to re- 
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ceive the Government Executive magazine’s 1998 government tech- 
nology leadership award. 

Treasury is continuing with an aggressive approach in address- 
ing non-IT devices that contain embedded chips. To date, we are 
over 90 percent compliant and expect to be fully compliant by June. 
We have been proactive in working to achieve compliance in tele- 
communications systems. We expect to complete interoperability 
testing analysis, independent verification, and validation of our cor- 
porate voice systems in May. We are also endeavoring to complete 
interoperability and IV&V testing of our corporate data network, 
the Treasury Communications System, by May. I convene and 
chair biweekly executive meetings in our command center to mon- 
itor our progress on telecommunications. 

Last summer, we established interagency services programs to 
address interconnections and interoperability of our disparate sys- 
tems. The scope includes all corporate Treasury systems, as well as 
non-Treasury services upon which we rely. We believe that we are 
aggressive and are a leader in the government for interoperability 
testing. 

As bureaus near completion for achieving year 2000 compliance 
for their mission-critical systems, the Department is placing in- 
creased emphasis on year 2000 business continuity and contin- 
gency plans, as well as focusing on completion of systems and inde- 
pendent verification and certification interfaces, and then testing 
and changing management processes. We are also designing a 
Treasury emergency information coordination center that will ad- 
dress any contingency planning needs at Treasury while also spe- 
cifically addressing the day-one strategy for January 1st. 

Our cost estimates for fixing the year 2000 computer problem 
have continued to rise in our submission of the February report to 
0MB; we now estimate a total cost of $1.92 billion, of which ap- 
proximately $1.53 billion are appropriated resources. 

On a positive note, there are some good outcomes for the future 
as a result of our efforts on year 2000. For the first time ever, we 
have a complete inventory of all Treasury IT, non-IT, and tele- 
communication systems and components. Wherever possible, we 
are modernizing our IT, eliminating duplicative systems, and mi- 
grating to standard commercial solutions, as we fix year 2000 prob- 
lems. We developed and refined program and project management 
skills, and created a new culture of our bureaus working together 
to meet common goals. Beyond year 2000, these efforts will allow 
Treasury to provide improved government services. 

I believe that Treasury has an excellent overall year 2000 pro- 
gram in place, and I will commit to you that we are taking all steps 
necessary to ensure that Treasury’s core business processes will 
continue to function without disruption as we cross into the year 
2000. Nothing less than 100 percent compliance and uninterrupted 
delivery of our core business services would be acceptable to the 
American public or to me personally. 

Thank you for the opportunity to meet with you today to discuss 
the actions being taken by the Department of Treasury in address- 
ing the year 2000 computer problem. I will be happy to answer any 
questions you may have on this critical matter. 

[The prepared statement of Mr. Flyzik follows:] 
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DEPUTY ASSISTANT SECRETARY JAMES J. FLYZIK 
DEPARTMENT OF TREASURY 
HOUSE GOVERNMENT REFORM AND OVERSIGHT 
SUBCOMMITTEE ON GOVERNMENT MANAGEMENT, INFORMATION AND 
TECHNOLOGY 

Chairman Horn, Chairman Morelia, and members of the Subcommittees, thank you 
for the opportunity to appear today to discuss the Department of the Treasury’s progress on 
the Year 2000 computer problem. The Year 2000 computer problem is our highest priority 
information technology challenge at the Department of the Treasury. Treasury has a strong 
program in place to address this challenge. 

The Assistant Secretary for Management and Chief Financial Officer (CFO) has 
overall responsibility for the Year 2000 date transition. As Deputy Assistant Secretary 
(Information Systems) and Chief Information Officer (CIO), I am the overall program 
manager for the Year 2000 effort. The day-to-day responsibilities of the Y ear 2000 program 
reside within my office. In addition. Treasury contracted with several firms with specialized 
skills in the Year 2000 problem to assist the Department in meeting this challenge. 
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Secretary Rubin is briefed periodically on the status of our Year 2000 program, and 
the Assistant Secretary for Management and CFO and I meet on a recurring basis with bureau 
heads to review their progress. Working groups meet regularly for the information 
technology (IT), Non-IT, and Telecommunications components of our program. The 
Department requires each bureau and office to submit detailed monthly status reports. 
Additionally, Secretary Rubin mandated that each bureau and office head select an executive 
official to be in charge of their Year 2000 program. This individual, typically at the CIO or 
CFO level or higher, is responsible for ensuring that the Year 2000 program at their bureau is 
completed in a timely manner. 

Since I testified before you in March of last year, Treasury has made significant 
progress in ensuring that our mission critical systems will operate correctly and our core 
business processes will function normally on January 1, 2000 and beyond. Treasury has 
identified a total of 328 mission-critical IT systems. Nine of these systems are being retired 
and 293 (91.8%) are Year 2000 compliant as of March 31, 1999. Eight of the 14 Treasury 
bureaus and offices met the government-wide goal of attaining Year 2000 compliance for 
their mission critical IT systems by March 3 1 . Three bureaus are proj ected to implement 1 1 
of the remaining 26 systems by the end of April, and thereby attain compliance for their 
mission critical IT systems. Thirteen of the remaining 15 systems, belonging to three 
bureaus, the Bureau of Alcohol, Tobacco, and Firearms (ATF), the Financial Management 
Service (FMS), and the Internal Revenue Service (IRS) are expected to be implemented by 
mid year. The last two are new IRS applications under development that will be 
implemented in the fall. Treasury has closely monitored the progress of the mission critical 
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systems and is confident that they will be operational in a compliant mode well before the 
Year 2000 rollover. 

Three of Treasury’s most visible bureaus, the Internal Revenue Service (IRS), the 
Financial Management Service (FMS) and U.S. Customs have made tremendous progress. 
IRS has 133 mission critical IT systems, four of which are being retired. Of the 129 active 
systems, 121, or 90% are now compliant, 124 (96%) have completed renovation, and 122 
(95%) have completed validation. IRS systems are converted and implemented according to 
a schedule consisting of seven implementation phases that are based on the semi-annual IRS 
production cycles. 

As of March 31, 1999, FMS is able to make 90% of its payments — over 775 million 
annual payments - using Year 2000 compliant and tested systems. This includes monthly 
Social Security and Supplemental Security Income payments. Veterans’ benefit payments, 
IRS tax refunds, Railroad Retirement Board annuity payments, Federal salary payments, and 
vendor/miscellaneous payments. The remaining payment systems are on target for 
implementation in April, including the Office of Personnel Management Payment System 
through which FMS issues Federal annuity payments. The system is already compliant but 
cannot be implemented until mid- April due to a dependency on required interface control 
changes. 

FMS manages the collection and processing of more than $2 trillion in federal 
revenues each year. The Electronic Federal Tax Payment System (EFTPS) through which 
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FMS collected $1.1 trillion or 56% of the government's total collections in fiscal year 1 998 
was determined to be compliant in Decembw, 1998. The collection systems, including the 
Internal Revenue Service (IRS) Lockbox, General Lockbox, Plastic Card Network and other 
collection systems, that account for the temaining 44% in federal government revenue were 
compliant as of the end of March, with the excqition of one of the 25 MS Lockbox 
applications, one plastic card application, and two applications in the Electronic Data 
Interchange System. Three of these applications are expected to be compliant by the end of 
April, and the fourth will be implemented in June 1999. 

Customs met the goal of achieving Year 2000 compliance for its mission critical IT 
systems by September 31,1 998. In fact, the Customs Year 2000 Program has successfully 
met program milestones established by Treasury, 0MB and GAO. The combined audit team 
&nm the General Accounting Office and the Treasury Inspector General’ Office found that 
Customs had established effective Year 2000 program controls. In addition, the Customs 
Year 2000 Program was one of nineteen federal programs out of a field of 200 to receive the 
(government Executive Magazine’s 1998 Government Technology Leadership Award. 

Treasury is continuing with an aggressive approach in addressing Non-IT devices that 
contain embedded chips and telecommunications systems. To date. Treasury is over 90% 
compliant in our Non-IT mission critical systems and expects to be fully compliant by mid 
June. In order to more closely monitor current progress of Treasury’s bureaus and offices, 
we have recently completed on-site bureau visits at eight of the 1 4 bureaus, and plan to 
complete the balance during April 1999. Concurrently, we are beginning an independent. 
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fonnal assessment and audit of our Non-IT testing and validation to confirm the status of the 
bureaus’ independent verification and validation (IV&V). 

Treasury has been proactive in working to achieve Year 2000 compliance in our 
telecommunications systems. We expect to complete interoperability testing and analysis, 
and independent verification and validation (IV&V) of Treasury’s corporate voice systems in 
May. Renovation on these systems is 99% complete - we are waiting on the upgrade to one 
vendor supplied management information system (MIS), scheduled for the July - September 
time frame. If necessary. Treasury can live without this MIS. We are also endeavoring to 
complete interoperability and IV&V testing of the corporate data network, the Treasury 
Communications System (TCS) by May, but may not be able to complete the testing until 
June or July due to the magnimde of the components. I convene and chair biweekly 
executive meetings in our Command Center to monitor our progress on telecommunications 
IV&V testing. 

Last summer, Treasury established the Interagency Services (IAS) 
telecommunications program area to address the interconnections and interoperability of 
disparate communications systems and services. Treasury has continuously worked to ensure 
that products among the different configurations supplied by the manufacturers and service 
providers are Year 2000 compliant. The scope of IAS involves all Treasury corporate 
telecommunications systems as well as other non-Treasury services upon which the 
Department relies. Included in the IAS scope are FTS2000, international long distance. 
Diplomatic Telecommunications Services, and local and long distance carriers. In addition. 
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IAS has initiated a plan to organize Treasury bureaus into a cooperative endeavor to perform 
joint component and interoperability testing of local telecommunications systems (PBXs, 
Key Systems, Voice Mail Systems, and Audio Response Units) used by multiple bureaus so 
that duplication of effort and cost is reduced. We believe that we are a leader in the 
government in interagency telecommunications testing. 

Treasury has also been aggressive in our oversight and outreach efforts. The Office 
of the Comptroller of the Currency (OCC) performs readiness examinations at each 
institution it supervises. These examinations focus on national banks testing processes, 
contingency planning, and customer awareness. Quarterly, the OCC will monitor Year 2000 
remediation progress at all national banking institutions through the first quarter of 2000 and 
take any steps necessary to deal with banks that fall behind schedule. In addition, OCC's 
Global Banking Division is developing a Global year 2000 Readiness Assessment System. 
The system will be a collaborative analysis tool to assist OCC managers and examiners in 
their evaluation of the global Year 2000 risks. It will assist in assessing the potential year 
2000 impact on U.S. banks' clearing and payment activities, credit risks, and exposures to 
international trading counterparts. Finally, the OCC participates with other regulators in 
seminars and outreach efforts to educate banks and the public about the Year 2000 effort. 

During February 1999, Washington and regional representatives of the Office of 
Thrift Supervision (OTS), together with other financial institution regulatory agencies, made 
presentations at ten meetings attended by personnel from thrifts and banks. Attendance at the 
various meetings totaled over 600 individuals from the financial institutions with 
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approximately 175 representing over 125 thrifts. OTS is currently conducting a round of on- 
site Year 2000 examinations of thrift institutions with in-house systems and service 
providers. Simultaneously, OTS is completing its current round of examinations of the 
thrifts. On April 15, OCC and OTS will host the second in a series of three summits for the 
representatives of all components of the financial institution community. The Summit theme 
is contingency planning and consumer awareness. 

OTS recently conducted end-to-end testing involving industry and other external data 
exchange partners at its remote disaster recovery center. The tests focused on the OTS 
systems that support the industry and regulatory functions. Preliminary test results indicate 
that the systems accurately processed the test data. OTS’ last Year 2000 tests are scheduled 
at the remote disaster recovery center for July 1999. 

System interdependencies have been identified by all bureaus. Various bureaus are 
awaiting letters of agreement of date format changes, while others are in the process of 
analyzing and testing their interfaces. Treasury has identified a total of 32 state data 
exchanges, although in some cases the exchanges are with multiple states. Four Treasury 
bureaus {BPD, IRS, OTS, and Customs) identified data exchanges with the state agencies. 
This information has been used to populate the GSA-maintained database of Federal data 
exchanges with states. 

As bureaus near completion of achieving Year 2000 compliance for their mission 
critical systems, the Department is placing increased emphasis on Year 2000 Business 


RR-3077 


7 



89 


Continuity and Contingency Plans (BCCPs), as well as focusing on completion of systems 
IV&V and certification, systems interfaces, end-to-end testing, and change management 
processes. Contingency planning and continuity of business planning have long been an area 
of emphasis by Treasury. The Year 2000 Program Office is reviewing the BCCPs in close 
coordination with the Office of Emergency Preparedness, and subsequently will work with 
the bureaus as needed to address issues that may be identified. Through development of a 
Baseline Management Plan, we are also designing a Treasury Emergency Information 
Coordination Center (EICC) that will address any contingency planning needs at Treasury, 
while also specifically addressing the Day One Strategy for January 1, 2000. 

Treasury’s cost estimates for fixing the Year 2000 computer problem have continued 
to rise. In our submission to OMB for the February 15, 1999, report, we now estimate a total 
cost of SI. 92 billion, of which approximately $1.53 billion are appropriated resources. Our 
cost estimates were initially based in large part on a Year 2000 cost model that focused on 
costs associated with mainframe lines of code. In the period since those initial estimates 
were provided, Treasury bureaus and offices have made significant progress in their 
inventory and cost estimate efforts for repair and testing IT items, telecommunications items, 
and Non-IT items. In the Febmary 15, 1999, quarterly report, we estimated Non-IT program 
costs of $49.7 million, and $395 million for telecommunications costs. 

On a positive note, there are some good outcomes for the future as a result of our 
efforts on Year 2000. For the first time ever, we have a complete inventory of all Treasury 
IT, non-IT, and telecommunications systems and components. Wherever possible, we are 
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modernizing our IT, eliminating duplicative systems, and migrating to standard commercial 
solutions as we fix Year 2000 problems. We developed and refined program and project 
management skills, and created a new culture of our bureaus working together to meet 
common goals. Beyond Year 2000, these efiforts will allow Treasury to provide improved 
government services. 

I believe that Treasury has an excellent overall Year 2000 program in place, and I will 
commit to you that we are taking all steps necessary to ensure that Treasury’s core business 
processes will continue to function without interruption as we cross into the Year 2000. 
Toward that end, I will also commit that we will complete the conversion, testing, validation, 
and implementation of all mission critical systems in time to avoid disruption to any critical 
systems. Nothing less than 100% compliance and uninterrupted delivery of core business 
services would be acceptable to the American public, or to me personally. 

Thank you for the opportunity to meet with you today to discuss the actions being 
taken by the Department of the Treasury in addressing the Year 2000 computer problem. I 
will be happy to answer any questions you may have regarding this important matter. 

-30- 
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Mrs. Morella. Thank you, Mr. Flyzik. I am glad to see there are 
some positive spinoffs also that accrue to this diligent attempt for 
compliance. 

In terms of questioning, we will also try to take about 5 minutes 
each and then go around for another round as necessary. 

So to Ms. Lee, in your testimony you mentioned Federal funding 
for year 2000, and it is true that last year Congress appropriated 
$3.35 billion just for year 2000 efforts, more than the administra- 
tion had requested, and yet many in the year 2000 community be- 
lieve that additional funds may still be necessary. And, quite frank- 
ly, on many we are expecting that the President would request ad- 
ditional funding in his budget. Is it still OMB’s position that it will 
not be necessary to appropriate additional funds for year 2000? 

Ms. Diedre Lee. At this point, we believe that the emergency 
funding is adequate to address the needs that have been identified. 

Mrs. Morella. How certain are you of this? What do you use for 
validation of that? 

Ms. Diedre Lee. The latest request that has been submitted and 
is in the waiting period is $199 million, which leaves about $500 
million. Based on expenditures to date and the best knowns of the 
unknowns, we believe that is going to be adequate. But we will 
continue to keep you apprised as we work our way through it. 

Mrs. Morella. I hope you will. And do you think that there is 
a pretty reasonable chance that there will be a request for more 
money in the forthcoming months? 

Ms. Diedre Lee. That would be a prediction on my part. I would 
be glad to try and get you more information on that. 

Mrs. Morella. It is just very interesting, because we have con- 
sistently felt that the administration has underestimated what the 
cost would be. 

Ms. Diedre Lee. Well, it certainly has grown from the original 
estimate. As the agencies continue to work on this and as more and 
more of the systems are remediated, and we move toward the com- 
pletion we believe the funding is adequate. These business con- 
tinuity and contingency plans, will look across the systems and try 
to ensure that we really do have the seamless delivery. We are 
making a lot of progress and it appears at this moment that we are 
going to get there with the funds we have. I will certainly validate 
that and get back to you. 

Mrs. Morella. Good. Thank you. 

[The information referred to follows:] 

To date, we’ve utilized emergency funds mainly to remediate Federal systems, test 
and validate results and develop Business Continuity and Contingency Plans. We 
continue to review agency funding requirements on a case by case basis as they are 
forwarded to 0MB. At the moment, we do not anticipate the need for additional sup- 
plemental funding for these activities. However, if additional funding requirements 
do arise, we will make you award of those requirements as soon as possible. 

Mrs. Morella. Mr. Willemssen, would you agree? 

Mr. Willemssen. One important thing to keep in mind is that, 
in the event that contingency plans, as we move to the end of 1999 
and into the next century, need to be activated, it is important that 
some amount of these emergency funds be held back so that they 
can, if needed, be available for use. So I think that it is extremely 
important that you continue your oversight with regard to the 
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amount of funds that have heen allocated to date. On the DOD 
side, 85 percent of the amount has heen allocated; on the civilian 
side, with the recent announcement of the fifth allocation, I believe 
it is in the neighborhood of the amount of three quarters of the 
$2.25 billion. So I think it is important to keep that in mind, that 
we have some amount of funds available in the event we have to 
implement contingencies. 

Mrs. Morella. I would like to ask you, Mr. Willemssen — and if 
Ms. Lee wants to comment — what Federal agencies are you most 
concerned with regards to meeting a January 1, 2000 deadline? 

Mr. Willemssen. The agencies that we would currently view at 
the highest risk would start probably with the Health Care Financ- 
ing Administration and the Medicare program in particular, but we 
also have concerns with Medicaid, which is, as you know, a State- 
administered program. Despite as we testified last month, a tre- 
mendous amount of progress made by the Federal Aviation Admin- 
istration, we continue to view that also as a high-risk agency be- 
cause of, as we testified, the many, many events and system imple- 
mentations that yet remain, and the heavy reliance on a computer- 
ized environment to carry out air traffic control activities. In addi- 
tion, I think HHS’s Payment Management System, which is re- 
sponsible for putting out more than $165 billion annually in grants 
and other funds to organizations, I think that is a fairly important 
system that needs continued attention. And then, as reflected in 
the statistics that 0MB has put together based on agencies’ sub- 
missions, the Department of Defense still has a number of systems 
that are not yet compliant. 

Mrs. Morella. Picking up on what you said and looking at also 
your testimony, which focused basically on State’s systems and how 
their readiness is essential for what you have said. Medicare and 
Medicaid and food stamps, temporary assistance, needy families, is 
there legislation that would be necessary to help with regards to 
States’ system that you would recommend? 

Mr. Willemssen. We do not see it at this point, the need for leg- 
islation. That could very well be the case within the next couple of 
months, to the extent that the partnerships that are necessary be- 
tween the Federal Government and State governments do not real- 
ize themselves. Hopefully, at this point in time, we can reach those 
partnerships in a voluntary fashion. 

One of the items that we pointed out in the testimony also, and 
related to this, is getting the necessary information on data ex- 
changes, which is integral to these kinds of programs, and to the 
extent that States and/or Federal agencies are not providing that 
kind of information, then in the very near future we may have to 
look at legislative remedies. 

Mrs. Morella. That is interesting to me. It could even be an Ex- 
ecutive order, couldn’t it? That could handle that? 

Mr. Willemssen. Possibly, yes. 

Mrs. Morella. And I would think that the timing would be such 
that we do not have too much time before a decision will have to 
be made. 

Mr. Willemssen. There is not much time. I would point to the 
April 15th submissions, due in 2 days on these critical programs — 
and to the extent that we see the necessary partnerships and detail 
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on the plan and milestones on the State-administered programs, I 
think that will give us a higher level of comfort that things will be 
done as is necessary. To the extent that we do not see the detail 
in those submissions, then I think there is more room for concern. 

Mrs. Morella. Thank you. 

My time has expired. It is now my pleasure to recognize Chair- 
man Horn. 

Mr. Horn. Thank you very much. 

Let me asked both the General Accounting Office and the rep- 
resentative of the Office of Management and Budget, is there any 
evidence in the recent submissions as to meeting the March 31st 
deadline of manipulation of data on the status of mission-critical 
systems? In another words, are agencies gaining the numbers to 
appear better positioned then they are, and what do we know about 
that. And has GAO looked at it, in particular; has 0MB looked at 
it? 

Mr. WiLLEMSSEN. We have looked at that when we go into par- 
ticular agencies and looked at how they are assessing, renovating, 
validating, and implementing particular systems. We have not seen 
any evidence of an agency consciously trying to game the system 
and play the numbers in order to make themselves look better. We 
have seen evidence that, as agencies get into their year 2000 pro- 
grams, and better understand what they are dealing with, and bet- 
ter understand what is truly mission-critical, that there have been 
some dramatic changes in the numbers. The further into their pro- 
grams that the agencies are, the less change that we have seen. I 
know there has been concern about the diminishing number of mis- 
sion-critical systems. Frankly, I am more concerned with the high- 
impact programs and making sure that the systems, the partners, 
the data exchanges, the data flows all supporting those high-impact 
programs work as intended. At this point and time, we need to 
focus on those and make sure that those are compliant from an 
end-to-end perspective. 

Mr. Horn. Ms. Lee. 

Ms. Diedre Lee. I would certainly reiterate that the number of 
mission-critical systems has fluctuated. We have watched that very 
closely to ensure that problem systems are not dropped off to reach 
100 percent. We think we validated that is not the case, because, 
otherwise, we would have 100 percent across the board. Certainly 
I will reiterate that, when we first started identifying mission-crit- 
ical systems, there are a lot of human beings involved, and, of 
course, “my system is, by definition, mission-critical.” As more 
planning was done, we found that although the immediate system 
user might consider it to be mission-critical, it really was not in the 
larger sense. For example there was a particular agency that origi- 
nally had identified a system that scheduling for an advisory com- 
mittee as mission-critical, and we subsequently determined that 
that probably could be moved to the less critical activity. Those 
kind of things have been happening. 

Mr. Horn. In you testimony, you mentioned what the Senate had 
done to some of the requests for funding. When Dr. Raines was the 
Director of the Office of Management and Budget, he put the em- 
phasis — as did this Subcommittee on Government Management, In- 
formation, and Technology of the House — on reprogramming money 
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being used to fix up the year 2000 situation, and we strongly 
backed him on that. The Speaker noted that we would give the ad- 
ministration — Speaker at that time — every dime they want, and 
they got every dime they wanted when they gave us a decent jus- 
tification. 

What has happened to the reprogramming, and couldn’t have 
these agencies used more reprogramming money? 

Ms. I3iedre Lee. There certainly has been a mix of the appro- 
priated funds planned in the budget as well as this particular 
emergency supplemental. The definition of those differences were 
ones that were in the appropriated amount, were those that could 
be more or less foreseen and were planned. The emergency supple- 
mental was used more for the contingency planning, and as things 
developed, more and more systems and issues were found. Re- 
programming has been done to a certain extent, but right now we 
feel that the emergency funding is the way to solve these particular 
contingencies. 

Mr. Horn. Madam Chairman, without objection, I would like to 
have a letter from the Office of Management and Budget as to the 
reprogramming money that existed on September 30, 1998, the end 
of that fiscal year, and what happened to it, for all 24 major agen- 
cies — what is the programming money; what was applied to year 
2000; what was sent back to the Treasury, et cetera — I would like 
it included at this point in the record. 

Mrs. Morella. Without objection, so ordered. 

Mr. Horn. OK. Now, on the U.S. Agency for International Devel- 
opment, Mr. Nygard, we have watched the charts for 2 years now 
where your seven critical systems, not one of them was adapted to 
become 2000 compliant. How come? Seems to me seven is pretty 
simple to deal with. 

Mr. Nygard. Well, Mr. Chairman, seven should be pretty simple 
to deal with. As I indicated in my statement, five of those systems 
need to be repaired; one is going to be outsourced, and we are in 
the process of doing that now, and the seventh one will be discon- 
tinued because it is no longer needed. Of the other five, we had 
hoped that three of them would be completed by the deadline, but 
in our end-to-end testing we found bugs outside the systems them- 
selves, but in the linkages with the other systems that caused us 
to delay our progress. The last two are continuing to move forward 
and four of the five are renovated now; the fifth will be renovated 
by the end of the this month, and we expect will be completed by 
the end of July for the last one, and by May for the others in terms 
of implementation. We simply did not make the deadline. We got 
a late start and encountered problems in testing. 

Mr. Horn. Mr. Nygard, when did you become the Chief Informa- 
tion Officer of the Agency for International Development? 

Mr. Nygard. Officially, I became the Chief Information Officer 
last October 28th. 

Mr. Horn. Was there one before you? 

Mr. Nygard. Yes, there was a Chief Information Officer up until 
June 1997, and then there was a gap, and I was sort of unofficially 
acting in that capacity until April of last year, and then from April 
until October I was the Acting Chief Information Officer. 
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Mr. Horn. In 1996-1997, we were told that the Agency for Inter- 
national Development was getting new systems and, therefore, the 
problem would be solved — and this was before your beat, obvi- 
ously — and they got the new system and nobody asked to make 
sure it was 2000 compliant. Yet when they replied to our survey 
of the Subcommittee on Government Management, Information, 
and Technology, it was clear they were buying the new system and 
did not have to worry about it because it would be compliant. So 
where did that all go wrong? It is not on your beat; it is prior to 
your beat. 

Mr. Nygard. Well, it is on the Agency’s beat certainly. We did 
not buy a new system; we were attempting to develop our own sys- 
tem. We wanted to have a client-server-based system, and at that 
time there just were not government-wide, commercial, off-the-shelf 
systems that we could use. So, we tried a very ambitious approach. 
The underlying software for that system was Oracle and was year 
2000 compliant, but in the individual applications that we devel- 
oped inside the Agency, we were not able to do them in a suffi- 
ciently integrated fashion, so that the date, the four-digit date, was 
done the same way in all of them. So what we had thought in 1996, 
going into the process, was going to result in easy year 2000 com- 
pliance, turned out not to be the case, and we have been working 
on fixing that since last year. 

Mr. Horn. You mentioned that we do not seem to have off-the- 
shelf client-oriented systems. Now I would think that problem 
would be on the doorstep of the General Services Administration. 
I would say to Ms. Lee, and wasn’t it? Why didn’t the General 
Services Administration have client-oriented, off-the-shelf stuff? We 
had $4 billion down the drain by the Federal Aviation Administra- 
tion in this administration. We had $4 billion down the drain in 
the Internal Revenue Service in this administration. Now, where is 
the problem? There ought to be, GSA ought to have stuff off-the- 
shelf. Why doesn’t it? Do you get it from GSA? Do you go out and 
do your own thing? 

Mr. Nygard. Mr. Chairman, they do now. At the time we were 
looking to develop an agency-wide system back in the early 1990’s, 
all of the commercial off-the-shelf systems that existed were still 
what are called mainframe systems rather than client-server. We 
were trying to move ahead of the technology that existed for gov- 
ernment agencies at the time and to develop a client-server-based 
agencywide system. What exists now, and what we are going to be 
using, will be off the GSA schedule, commercial off-the-shelf finan- 
cial system to begin with. 

Mr. Horn. Well, I am delighted to hear that $8 billion results in 
something. So, that is good news to me today. 

Thank you. Madam Chairman. 

Mrs. Morella. Thank you. Chairman Horn. 

I am pleased now to recognize Ms. Jackson-Lee for any questions 
she may have. 

Ms. Jackson-Lee. As usual, let me thank the chairwoman for 
what has been an ongoing series of very vital hearings, and I ap- 
preciate very much the insight that has been given, and of course 
experienced some of the pain that we have evidenced here today in 
some of our hearings. I would like to followup on a line of question- 
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ing, and hope that the panelists recognize that all of us in Congress 
want to be able to be of help to this process that is befuddling most 
of America. 

I think the new state of confusion for the country is certainly 
surrounded or is around year 2000, meaning that if you go into any 
community and raise the question, you will get all kinds of answers 
of what it means, and I have said for some it means survivalist 
camps, and others underground facilities, and just a lot that we 
hope we can clarify. And so it is important that the Federal Gov- 
ernment be as prepared as it possibly can. 

To followup on that, then I would like to ask all of the witnesses 
to give me a sense of what is the general level of preparedness that 
you believe State governments are engaged in and why, and if you 
don’t know the answer, why we don’t know the answer? Why 
should we be engaged on the Federal level to be able to assess 
what is going on in our State governments, because don’t they 
interrelate with the Federal system, and therefore there is a seri- 
ous impact that will occur if our State governments — 50 of them — 
are not up to speed, and what specific actions do you think we 
should take? And I would like to start with the GAO on that ques- 
tion. 

Mr. WiLLEMSSEN. A couple points that I would like to make: 
First of all, the data that we have seen among States, there is a 
tremendous variance among States on their readiness, and even 
within States, among different programs, there is quite a bit of 
variance in readiness. So, on one hand, it is hard to generalize. 
However, if one had to generalize based on the data that we have 
seen, I think you would say that the State governments overall are 
behind the Federal Government. One of the reasons for that is that 
most of the data that we have seen at the State government level 
is self-reported information. There are few instances where other 
organizations have gone in and looked at the data. In some cases 
the ground truth is actually a little worse than what has been re- 
ported. 

Last year when he took a look at some of the key human services 
programs, the self-reported State data we were provided was quite 
disappointing. Regarding Medicaid systems, only about 16 percent 
of those were considered compliant, and that was self-reported in- 
formation. Based in part, on those kinds of data points, the Health 
Care Financing Administration actually hired a contractor to go 
out to all 50 States to help them to try to get on top of this issue. 

So I think that the State issue is one of concern, I think it is one, 
though, that has been recognized by the executive branch, in large 
part through the recent memorandum that they have issued focus- 
ing on about 10 of the State-administered programs. And with Fed- 
eral agency lead partners helping with those States, I think that 
has the potential to go a long ways toward helping to address this 
issue. 

Ms. Jackson-Lee. Can you name for us and help us find a bot- 
tom line for the five worst States that are not in compliance? 

Mr. WiLLEMSSEN. Actually, the report we did in November, it 
was hard to generalize even at a State level, because within a 
State the food stamp program may have been in better shape then 
the Medicaid, whereas the Temporary Assistance for Needy Fami- 
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lies Program may have been very bad. So, even within the State, 
it was difficult to generalize. 

I will say that there are certain States that have been working 
on this for some time. The State of Pennsylvania, for example, has 
been considered a leader within the year 2000 arena; that is not 
again to say that every program within that State is necessarily 
where it needs to be. Other States have also, within pockets, re- 
ceived publicity and good press for their excellent efforts, but, 
again, it is hard to generalize within a given State, because even 
a chief information officer within a State may not have full control 
and authority over all of those programs. 

Ms. Jackson-Lee. Mr. Willemssen, you are using great diplo- 
macy by answering my question with a positive, but I will try to 
pursue it with you directly and separately from this hearing, as to 
where some of our States are that need serious help. Because I be- 
lieve the question that Chairwoman Morelia asked you about 
whether or not we may need more money, it seems that we might 
need more money to be able to assist some of the States that may 
not be where we need them to be. 

And I see the red light, if the chairwoman would indulge me just 
for a question and I won’t ask the rest of the panel to answer that 
question. 

I thank you, Mr. Willemssen, but I will ask Ms. Reed to followup. 
In particular, I am concerned — I chair the Congressional Children’s 
Caucus — and I am concerned with respect to the Agriculture De- 
partment. Child nutrition, food stamps, WIC, rely heavily on State 
information systems, and we understand that some States won’t 
even be in compliance until 1999. So what contingency plans is 
USDA engaging in to help some of these States with their compli- 
ance? 

Let me, before you answer that, just note to my friend from 
USAID, that we applaud the great work that you do. I have just 
returned from Africa and I know the work that you do, and in dif- 
ficult areas, in developing nations. However, it seems that it will 
be a great burden if you have seven systems and all seven of them 
are not working at this point. 

My time has run out, but if you are able to answer that com- 
ment — if the chairwoman indulges me — otherwise, I would take 
your answer in writing, but I would like to hear from Ms. Reed, 
who is with USDA. 

Ms. Reed. The Food and Nutrition Service has been working 
with the States since 1967 to make sure that they are aware, and 
that we are aware, of what needs to be done in these arenas. 

Ms. Jackson-Lee. Did you say 1967? 

Ms. Reed. 1997. 

Ms. Jackson-Lee. Thank you. 

Ms. Reed. I apologize. We weren’t quite that prescient. [Laugh- 
ter.] 

Ms. Jackson-Lee. You are quite ahead of your time. 

Ms. Reed. Thank you for that. 

However, we do now receive quarterly reports from the States. 
We have one that is just imminent here; the last report that I have 
is from December. A number of the States are reporting that they 
are compliant, but, as you indicate, some of the States do show that 
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they don’t plan to be compliant until quite late in the year. So we 
are requiring business continuity plans from each State. We are ac- 
tually requiring each State to certify their compliance as we move 
into these later months. Our State directors and regional directors 
are working very intensively with the States to assure that we 
have the most information possible and, where necessary, can pro- 
vide technical assistance to them. 

Mrs. Morella. Thank you, and thank you, Ms. Jackson-Lee. 

Ms. Jackson-Lee. Thank you. 

Mrs. Morella. Mr. Gutknecht, I am delighted to recognize you, 
sir, for the questioning. 

Mr. Gutknecht. Thank you. Madam Chair, and it is good to be 
here. 

Let me start by saying that I have had a couple of townhall 
meetings in my district about year 2000, and I am happy to report 
the State and local government officials who have testified — at 
least in my State — are more than eagerly moving forward with 
their plans, and I think we are making tremendous progress — at 
least in my State. And I feel pretty good about what we hear from 
some of the Federal agencies. 

But I want to come back to a point that Dr. Horn raised, and I 
think the real issue is about accountability. You know, it is dis- 
turbing that the FAA and — I will try to be diplomatic — in the end 
we wasted $4 billion, the FAA, and the story is that we also wasted 
$4 billion with the IRS. And I am not certain who to address this 
question to, but it strikes me that in the private sector, and one 
of the reasons — I think at least the major corporations; I am not 
so certain about small businesses — the only area that I am really 
worried about in terms of where we are going to be January 1st 
of next year, in my opinion, has much more to do with what is hap- 
pening with small businesses, who are to busy or haven’t taken the 
time, or for whatever reason. The SBA, Madam Chair, I might just 
say — and we should make this available and maybe connect some- 
how to our website, whatever — SBA does have a wonderful kit 
that they have put together, including a CD ROM that sort of helps 
walk small business through what the problems are and what they 
need to look for, and so forth. And I really want to congratulate the 
SBA. 

But I want to come back to a point that concerns me and it is 
the word “accountability.” I think most major businesses — and we 
have had major airlines and some of the power companies and 
other companies come and testify at our townhall meetings about 
what they are doing with year 2000. They understand that this is 
serious. In fact, my first hearing we had, I think there were six 
companies that testified, and collectively, they were investing 
somewhere in the neighborhood of $150 million to make certain 
their systems would work on January 1, 2000. The reason, I think, 
is they understand that ultimately they are going to be held ac- 
countable. 

I think the question that I have for anyone who wants to respond 
to it — ^you know, in the private sector there is an unwritten system 
of rewards and punishments. And I might just ask this question — 
maybe somebody can answer it — in both the situation with the 
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FAA and the IRS, was anybody replaced or demoted because of the 
$4 billion which was wasted? 

Mr. Flyzik. If you would like, from the perspective of Treasury, 
I would suggest to you that the majority of the folks at the IRS 
that were part of that are no longer at the IRS. I don’t know, spe- 
cifically, whether or not it was resulting directly from this or not. 
I will suggest to you that we have learned some lessons, and I will 
suggest to you that we were building systems back then with some 
1980’s approaches with 1990’s technologies. I think, the Klinger- 
Cohen legislation, passed by the Congress, clearly, puts responsi- 
bility on the CIO. I do believe that the legislation passed by the 
Congress makes it clear that the chief information officers are now 
responsible. I accept that responsibility and plan to stay through 
the year 2000 program at Treasury, and we jokingly say that CIO 
may mean “Career is over,” if we do not meet our year 2000 re- 
quirements. But I think the Congress passed the lOinger-Cohen 
legislation that makes it clear that CIO’s are now accountable, and 
I think some of those lessons of the past are the reason the legisla- 
tion was passed. 

Mr. Gutknecht. Anybody else want to respond to that? Is that 
generally felt throughout the various agencies, that people are 
going to be held accountable? 

I see some heads nodding; those don’t show up on the tape. 

Ms. Reed. I will, on behalf of the Department of Agriculture — 
the Secretary of Agriculture has made it very clear that not only 
the CIO is accountable, but every single Under Secretary, every 
single agency administrator; their jobs are on the line, to make 
sure — our jobs are on the line — to make sure that we can continue 
to deliver USDA’s programs. He has been most clear and emphatic 
on that point. 

Mr. Burbano. I would like to second that from the State. The 
Under Secretary for Management has put the responsibility for 
year 2000 delivery on every Assistant Secretary, including the CIO, 
which is me. 

Mr. Gutknecht. All right, can I change the subject real quick, 
because I see the yellow light is already gone, and really I want 
to come back to Mr. Burbano. 

As I say, I feel fairly confident that somehow our State and Fed- 
eral Government and local governments are going to slug through 
this thing, but I am much more concerned about what is going to 
happen in foreign countries. I don’t know how well you guys are 
plugged into — you are the best guesses we have got in terms of 
what is going to happen in some other countries, some of our trad- 
ing partners around the world. What is your best guess, what is 
going to happen? 

Mr. Burbano. OK, we have an international working group com- 
prised of several agencies in the international affairs arena, co- 
chaired by the Department of Defense and State Department, and 
the Secretary has tasked each chief of mission, the Ambassador, to 
fill out a contingency plan toolkit that we have, which is due back 
April 16, which we will then put together and look where the gaps 
are. It is very detailed. It looks at the energy, water, transpor- 
tation, telecommunications, healthcare, finance, public services, 
and technology systems of every post and every country, and based 
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on what we have seen in there, we will be in a position to do that. 
So that is one side of the house. 

The other side of the house is we are collecting information from 
all the different agencies, as well as different private sector firms 
such as Gartner, putting it together, and we plan to have that in- 
formation available sometime during this summer, which will give 
us that kind of information. Obviously, you know, we have to be 
concerned about possible release of that data in order not to cause 
harm. So we are in the mist of grappling with that issue. But we 
plan to be prepared to have that information this summer, and we 
plan to prepare to have these contingency plans post-by-post, coun- 
try-by-country. April 16th is when we are due, and then we have 
to do some analysis, and so forth. 

Mr. Gutknecht. OK, thank you. 

Mrs. Morella. Thank you, Mr. Gutknecht. 

Mr. Burbano, picking up on that same issue, what percentage of 
State Department year 2000 funds are being specifically designed 
for embassies abroad? 

Mr. Burbano. I would like to get those figures back to you. I 
don’t have it broken down by overseas, but I would like to get those 
figures back to you. 

Mrs. Morella. Sure, that would great, because I am actually 
also interested in whether or not the allocation is based on certain 
criteria that you have established. I mean, for instance, would our 
embassy in Italy have more in the way of year 2000 funding then 
our embassy in Tanzania? I mean, what do you use for criteria in 
that regard? And then, you know, I am interested also — and I know 
my colleagues are, too — in what contingency plans you have for em- 
bassies and in countries that are not year 2000 compliant. I think 
we have all had experiences with questioning the authorities in so 
many of the countries, including industrialized countries, and find 
that their responses seem to be in a vacuum with regard to under- 
standing the situation, let alone implementing it. So if you could 
get that information to me, and actually to all of you, I guess I 
would ask the agency representatives, the CIO’s. 

GAO has, in its testimony, made many recommendations, such 
as establishing the target dates for contingency plans, the end-to- 
end testing, requiring the agency head to certify that systems are 
truly compliant, implementing a moratorium on software changes 
to ensure that these systems are compliant at the turn of the cen- 
tury. And I guess I would ask you is, do you agree with those rec- 
ommendations? Do you plan to implement them? And I will start 
with any one of you, any one who wants to begin. 

Mr. Flyzik. Throughout the entire process of year 2000, we have 
had at Treasury a very positive working relationship with GAO. 
We have used the GAO guidance throughout the entire process, 
their contingency planning model, and it truly has been a value- 
added kind of work process we have used with GAO, and we intend 
to continue to use their guidance. 

I think the change management moratorium will be relatively 
controversial. There are many, of course, industry counterparts 
that have strategic plans where they are moving forward, and as 
changes are made in the commercial sector, it will impact some of 
the things we are doing. 
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We also have, for example, at Treasury the IRS, where tax law 
changes are going to require certain changes. What we will likely 
do at Treasury is implement some type of exception process to min- 
imize any changes, but I think we will need some flexibility in that 
guidance for things that are just out of our immediate control. 

Mr. Burbano. At the State Department this past fall we issued 
a moratorium on development other than year 2000. We did have 
an exception process for security, health, and other items. Up to 
date, we have put about 26 systems on the shelf as a result of not 
being year 2000 or security-or health-related. We are also issuing 
a moratorium this July on operating systems and off-the-shelf sys- 
tems, and in September for application systems. 

In terms of an earlier question about the countries and embas- 
sies, as I mentioned, when we get back our contingency plans 
which look at various systems I talked about — the energy, the 
water, transportation, telecommunications, healthcare, finance, 
public services, and technology — that is our criteria. We see where 
the gaps are, and when we get the information this summer from 
the international working group as to where the countries are, as 
opposed to the post, we will put those together and we will clearly 
see, you know, what additional funds are needed based on those 
two items, the post situation and the country situation. 

Mr. Nygard. We at USAID have also been following the GAO 
guidance pretty closely. We find it useful, particularly the morato- 
riums. It has helped us to fend off requests from inside the agency 
and elsewhere for changes, just saying that year 2000 has to have 
the highest priority. So we found it very useful guidance and have 
been following it closely. 

Ms. Reed. I certainly will echo that for the Department of Agri- 
culture. We have tried very consistently to follow their guidance 
and have found it quite helpful in that regard. We, too, will be 
looking very closely at the change management program. We are 
extremely cognizant of the need to assure that there is stability as 
we go into the year 2000. 

One of the issues that we are continuing to wrestle with is that 
some of the software that has been determined to be compliant by 
vendors, who continuously send us patches and upgrades. We cer- 
tainly want to be in a position, if a software vendor recommends 
to us that we need something for year 2000 compliance that we had 
not foreseen earlier or they had not foreseen earlier, that we still 
able to implement it. So we need to be looking carefully at just how 
we approach achieving that stability. 

Mrs. Morella. I would like to also just briefly ask you, are all 
of the four agencies that we have before us, have all of you under- 
gone the independent verification and validation process? Say yes 
and no. 

Mr. Flyzik. Absolutely. 

Mr. Burbano. Yes, and I would say that we have done it at two 
levels. We did it first within the CIO office in the bureau, and then 
we are doing it at a second level with the Office of the Inspector 
General, and we developed that criteria. So we are actually going 
through it twice. 



102 


Mr. Nygard. Yes, we, too, are using independent validation and 
verification, and then after that, all of our systems will be reviewed 
by our Inspector General. So we have two stages as well. 

Ms. Reed. IV&V has been a very, very key part of our year 2000 
management program and will continue to be, as has our work 
with the Inspector General. 

Mrs. Morella. And, Ms. Lee, will you be requiring that all agen- 
cies undergo the IV&V? 

Ms. Diedre Lee. That is part of the system, not only the mis- 
sion-critical system assessment, but also as we do the seamless 
program checks; we will verify that that has been done. 

Mrs. Morella. What if agencies say they don’t have the time to 
do it? Would you be helpful? 

Ms. Diedre Lee. We haven’t heard that to date, and because of 
the schedules of the mission-critical systems, that schedule that 
they put in place includes the IV&V piece. In fact, some of the 
agencies that are not yet 100 percent, that is the piece they are 
missing; they have gone that far. If they haven’t completed that, 
they are not in the 100 percent category. 

Mrs. Morella. Well, thank you. 

Chairman Horn, your turn at bat. 

Mr. Horn. Thank you very much. 

The Director of 0MB sent out memorandum to the head of the 
executive departments and agencies, dated March 26, 1999, and 
without objection, I would like that included in the record at this 
point, because my questions will relate to that memorandum. 

Mrs. Morella. Without objection, so ordered. 

[The information referred to follows:] 
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March 26, 1999 


M-99-12 


MEMORANDUM FOR THE HEADS OF EXECUTIVE DEPA.RTMENTS AND 
AGENCIES 

FROM; Uacob J. Lew 

Director 

SUBJECT: Asauriiia the Year 2000 Readiness of High 

Impact Federal Programs 


During the past year the. Federal go-rarnment overall has 
made substantial progress in addressing the vear 2000 
problem in Federal systems. While many agencies have made 
outstanding progress on both internal systems and on their 
work with their program partnerc, other agencies must 
redouble their efforts to ensure that their mission critical 
systems will be ready and that their programs with a high 
impact on the public will function. We have consistently 
worked with you through the budget process and in other ways 
to ensure that your partner?s systems are also Y2K 
compliant; however, we need to be able to demonstrate the 
overall readiness of systems — and the programs they 

support -- to the public. 

This is a critical facet of our work. IVhile the public 
generally underctandc chat wo have made progress in 
addressing the year 2000 problem based on our internal 
measure of systems made compliant, their bottom-line concern 
is that the programs they rely on will function properly. 
Many Federal programs rely on partners such as other Federal 
agencies. State, tribal, and local governments, contractors, 
banks, and others . We must take an even stronger leadership 
role and work with our partners to assure they'have 
addressed any year 2000 problems that cmild effect F=deral 
programs, jointly test that the Federal program’will 'work, 
and together publicly demonstrate that it will. 

In the attachment, we have identified a number of high 
impact r ederal programs and we have assigned a lead agency 
i.or each program. cor each program where your agenev is the 
lead, please identify to OJIB the partners integral to 
program delivery; take a leadership role in convening those 
partners; assure yourselves that each partner has an' 
adequate T2K plan, and if not, help each partner without 
one; and develop a plan to ensure that the program will 
operate effectively. Such a plan might include testing 
data exchanges across partners, developing complementary 
bll.si ness continuity and contingency plane, charing key 
information on readiness with other partners and the public 
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and taking other steps that you and your partner feel are 
necessary to ensure that your agency?s programs will work. 


We realise that you have been budgeting for the 
effective operation of these high impact systems for some 
time, including Y2K compliance, and have been providing much 
necessary assistance to your partners to ensure that they 
are fixing their Y2K problems. Nothing in this memorandum 
or the process it sets in motion is intended to indicate to 
any agency or any partner in a high impact program, that 
there is new money available in lieu of the funds they 
already have to administer programs effectively ? which, 
by definition, includes making their systems Y2K conpliant. 

For each program for which your agency is listed in the 
attachment as the lead agency, I ask that you provide 0MB 
with a schedule and milestones for the key activities in the 
plan, a monthly report of progress against that schedule, 
and a planned date for an event or events to inform the 
p\iblic that the program is year 2000 ready. It would be 
most helpful if public events could be held prior to 
September 30, 1999. 

Please provide a copy of the schedules for those 
programs for which you are the lead agency to 0MB by April 
IB, 1999. Please also provide the first monthly statuss 
report detailing progress against that schedule by May 15, 
and by the 15th of each month thereafter until the work is 
complete. Schedules and reports can be sent to: 

Office of Management and Budget 
OIPA Docket Librar^^ 

NEOB 10102 

725 17th Street, m 

Washington, D.C. 20503 

Reports may al.sn he faxed to 202-395-5806. Ms. Pamola 
Beverly is available to answer any questions regarding the 
process of submitting schedules or reports at 202-395-6S80 . 

Please note that this effort is not intended to give 
Federal agencies any additional responsibilities, nor are 
Federal agencies expected to fund fixes or systems other 
than their own. Rather, this effort should be one of 
cooperation and partnership among interested parties, all of 
whom share a mutual interest in ensuring that important 
Federal programs will function smoothly through the vear 
2000 . 


Thank you for your continuing work on this essential 
effort. If we all continue to work together, we can, as che 
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President said, make this problem the last headache of the 
20th centvirv', not the first crisis of the 21st. 

Attachment 


cc; Agency Chief Information Officers 


Attachment A 

Federal Programs and Lead Agencies 


Lead Agency 

Program 

Agriculture (USDA) 

Child Nutnlion Programs 

USDA 

Food Safety Inspection 

USDA 

Food Stamps 

USDA 

special Supplemental Nulridon Program for Women. Infanrs. and Children 

Commerce (DOC) 

Patent processing 

DOC 

Weather Service 

Defense (DOD) 

Military Hospitals 

DOD 

Military Retirement 

Education 

Student Aid 

Enetw (DOE) 

Federal electric power generation and dcljverv 

Health and Human Services 
(KH5) 

Child Caie 

HHS 

Child Support Enforcement 

HHS 

Child Welfare 

lUIS 

Disease monitoring and tiw ability to issue warnLuas 

HHS 

Indian Health Services 

HHS 

Low Income Home Energy Assistance Program 

HHS 

Medicaid 

HHS 

Medicare 

HHS 

Orgeu UaiuplatiCh 

HHS 

Temporary /Assistance for Need>’ Families 

Housing and Urban 

Housing loans (GNMA) 
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Lead Ai^ency 

Propam 

Peveiopment (HUB) 


HUB 

Project'bnseci ilouaiag (Secston S) 

HUB 

PubJic Housiiig (Chants, FHA Mortgage insurance) 

Intetior (BOX) 

Bureau of Indian Af^irs programs 

Justice <BOJ) 

Federal Prisons 

DOJ 

Immigration 

Laimr (DOL) 

Unes:q}ioymenc rnsunmuc 

State 

Passport Applications and Processing 

TraasporUtion (DOT) 

Air Traffic Control System 

DOT 

Maritime Search and Rescue 

Treasury 

Cross-border Inspection Serv'ices 

Veteraos Affairs (VA) 

Veteran’s Beaetits 

VA 

Veteran’s HealtixCare 


Disaster relief 

Office of Personnel 

MauagesMiit (OPM) 

Federal Employee Health Benefits 

OPM 

Federal Employee Life Insurance 

OPM 

Federal Employee Retirement Benefits 

Railroad Retirement Board 

Retired Rail Workw Benefits 

Sodal Security AdxninbirttUuu 

Suciol Sccuiilv 

Postfld Service 

Mail Service 


TOTAL P.04 
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Mr. Horn. Ms. Lee, there are roughly 19 departments and agen- 
cies that are shown in his attachment, and that is where the 42 
programs come from. I wonder if you could just tell me, how were 
those 42 programs selected? 

Ms. Diedre Lee. We actually went out to the agencies and got 
agency input, as well as other governmental input. I think this 
might be a time to mention that, as we were talking about concerns 
of the States and other governments, we do have the President’s 
Council on Year 2000 Conversion, and they have been very active 
in dealing with the Governors’ associations, outreach programs, 
meetings, et cetera. That is also going on as we speak, and gen- 
erally John Koskinen, who represents that group, speaks of their 
outreach activities and their accomplishments. 

But through the consultation process with the agencies, and with 
the State and local governments, and in assessing the programs 
that had direct impact on people, this list was developed. But, it 
is an ongoing list, and should you have other programs that you 
feel are important, we are more than happy to add those, and make 
sure we have a lead agency assigned to it and that we monitor the 
progress. 

Mr. Horn. Well, was the criteria based on what is the most that 
these programs are in relation to people? Is that it? You just said 
that. 

Ms. Diedre Lee. I can get you the specific criteria that we went 
through, but, generally, it was: what are the major programs that 
cross agency lines that we couldn’t say are mission-critical? Pro- 
grams that may cross numerous agencies. State, local governments, 
and that have a delivery or an end product that we think we di- 
rectly affects health, welfare, and safety of people. 

[The information referred to follows:] 

We have asked Federal agencies to work with their partners to assure that all 
Federal programs will work. In developing the list of high impact programs about 
which agencies are reporting status information to 0MB, we looked at the Federal 
government from an individual’s point of view and selected programs that, if inter- 
rupted, would have a direct and immediate impact on individuals. 

Mr. Horn. Well, as it reads, you are absolutely right, that is the 
basic criteria, it would seem to me, both with other agencies to the 
Federal Government, as well as with State and local agencies, and 
I don’t have a problem with that. But I guess I would ask the ques- 
tion, where are some of the very difficult programs that might not 
meet that criteria, but must be taken care of long before January 
1, 2000? Let me give you an example. 

I don’t have a problem with the Department of Defense having 
its two programs of military hospitals and military retirement. 
Granted, they are, in essence, very much like what you have under 
USDA, or you have under HHS, or you have under HUD programs 
that affect a lot of people. I guess what I do worry about is, where 
is about the 100 or so readiness programs that the Department of 
Defense ought to have on this list? Is there a separate list floating 
around? 

Ms. Diedre Lee. OMB didn’t create a separate list, but we do 
acknowledge and recognize the Department of Defense has a lot of 
military programs. Certainly, some would say you could add them 
to this list. But because we generally say they are not something 
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that an individual per se has an interaction with, the Department 
of Defense on military systems are not put on this particular list. 
Nevertheless, we are very aware of that issue and DOD is tracking 
their mission-critical systems as well. 

Mr. Horn. So you have a list of the readiness programs? 

Ms. Diedre Lee. I believe DOD has that list. I can certainly get 
it for you. I don’t have it at this meeting. 

[The information referred to follows:] 

The Department of Defense is closely tracking the Y2K status of its readiness pro- 
grams. We are confident that the DoD systems will he ready for the new millennium 
and that the Department will be able to continue to carry out its missions. 

Mr. Horn. All right, because I guess I would ask you, what are 
the key programs that are not on this list, and that would include 
all agencies? I mean have we — is this it? Or are there others even 
on the domestic non-military agencies? 

Ms. Diedre Lee. These are the 42 high-impact programs that we 
have identified on the non-military side, with those two exceptions. 
But it is a continuing list, and as we progress farther in the busi- 
ness continuity and contingency plans, we could identify additional 
programs to be added. 

Mr. Horn. Now, as I understand it, there are master plans for 
each of these high-impact programs to guide the key organizations 
to be sure that they work, one, together; No. 2, that they really 
work, and No. 3, that they be brought in, I guess by, April 15th. 
Is that roughly it? 

Ms. Diedre Lee. We are looking for the business continuity and 
contingency plans to be in on April 15th, 2 days from now. We will 
then look at those plans, along with GAO, for thoroughness and 
other issues. That is going to give us the next step on. If they are 
thorough and descriptive and end-to-end, we have one situation, 
versus if there are pieces of information missing or holes or there 
is non-continuity, we have another situation. 

Mr. Horn. It is good to know that on April 15th, when taxpayers 
are sweating out paying the revenue side of the coin, that agencies 
are sweating it out paying the expenditures side of the coin. So 
that 

Ms. Diedre Lee. Share the wealth? 

Mr. Horn [continuing]. I find a certain symbolism in this; maybe 
you don’t? In your opinion, when will these high-impact programs 
be certified as year 2000 ready? 

Ms. Diedre Lee. It will be program by program. I wish I could 
tell you there is going to be one date. But that is going to be part 
of the plan, and part of the contingency plan is going to maintain 
the schedules and the milestones. From there we will set up the 
tracking mechanism. I feel certain that we will be back to discuss 
that with you further. 

Mr. Horn. OK. Now, let me ask both you and Treasury, to which 
this is relevant, the President held his second statement on the 
year 2000 acknowledging Social Security’s very good job of compli- 
ance. I had assumed, when he did that, that he also knew that the 
Treasury’s Financial Management Service had been 2000 compli- 
ant. And I guess I need to ask the Treasury representative, is the 
Treasury’s Financial Management Service compliant? Because, as 
you know, it needs to turn out about 43 million checks a month 
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from the Social Security Administration. I guess I would ask you, 
to what degree is FMS compliant? 

Mr. Flyzik. Chairman Horn, as noted in my testimony, over 90 
percent of the payment systems are now using year 2000 compliant 
software, including Social Security and supplemental security in- 
come payments. The last payment system to be made compliant is 
the Office of Personnel Management Payment System for Federal 
annuity payments. That system is ready to go at the FMS and it 
is waiting on an interfacing system. For those systems where FMS 
did not meet the March 31st deadline, you should be aware that 
FMS, in many cases, is waiting on other interfaces with other 
agencies to actually implement year 2000 compliant systems. So, 
the FMS system is ready to go. 

Mr. Horn. OK, let us just take Social Security. Is it ready to go 
100 percent on Social Security? Can they cut the checks? Can they 
send them? Then the question is, what about the depositories, cred- 
it unions, banks, whatever? 

Mr. Flyzik. Yes, in terms of cutting the checks, the answer is 
yes. In terms of the banks, the depositories are. Office of the Con- 
troller of Currency, as well as the Office of Thrift Supervision, con- 
tinue inspection programs. Their latest report sent to the Congress 
indicates over 90 percent of the financial institutions being year 
2000 ready. So, we are on a very positive trend. We are putting to- 
gether and are doing testing among FMS, IRS, Social Security, and 
all of the revenue collection agencies, as well as the payment agen- 
cies, end-to-end and interoperability testing, simulating configura- 
tions in a laboratory environment. 

Mr. Horn. OK, let me just go down the line: Are you ready to 
submit your April 15th report and plan to 0MB? Will you be able 
to do it on time? How about Treasury? 

Mr. Flyzik. Yes, we will, and sitting right behind me is my pro- 
gram manager — who does all the work that I get all the credit 
for — is working on that as we speak. 

Mr. Horn. So if you go, he goes, is that it? [Laughter.] 

OK, or is it the other way around? 

Let me ask the gentleman from the Department of State: Are you 
ready on that April 15th? 

Mr. Burbano. Yes, we are ready. 

Mr. Horn. OK. Let me ask Mr. Nygard of the Agency for Inter- 
national Development. 

Mr. Nygard. Mr. Chairman, I think we get a bye on that; we 
don’t have any systems on that list. 

Mr. Horn. Well, I would have put you on the list 3 years ago, 
Mr. Nygard. So, I mean, what is there left to do? Are you going to 
be able to do this job in AID or are we going to go back to the aba- 
cus? 

Mr. Nygard. No, we are there. We will do the job; no question. 

Mr. Horn. OK. Yes. They are now your ward, by the way; you 
are the guardian now of AID, right? So what is happening on the 
Department of State with its new child? 

Mr. Burbano. Well, we are integrating with USI and with 
ACTA, and we have met and continue to meet with USI and ACTA, 
and we plan to be fully compliant with our systems with both of 
those before the end of the year at this point. I would like to say. 
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in terms of the 40 systems that you were addressing on the pass- 
port issue, that system is out of the independent test and valida- 
tion phase; it is in deployment, and we plan to have that system 
fully implemented, the 14 passport offices, by the end of this 
month. So, not only will we have our report in, but we will have 
the system fully implemented by the end of this month. 

Mr. Horn. Well that is good news, because you do — what — over 
a million passports a year? 

Mr. Burbano. Yes. 

Mr. Horn. I know it is substantial and you have had a very effi- 
cient operation, as I have seen it. So this will carry that on? 

Mr. Burbano. Absolutely. So, again, we are fully implemented by 
the end of this month on our one system that is on that list. 

Mr. Horn. Now, will the Agency for International Development 
be part of your jurisdiction? 

Mr. Burbano. No, that is why I was saying it is USI and ACTA. 
We do work closely as my counterpart mentioned. 

Mr. Horn. You are all in the same building, so I wouldn’t think 
it is to hard to communicate. 

Mr. Horn. No, no, we work together, but we are not integrating 
their systems as we are with USI and with ACTA, so we do work 
and exchange information. They are part of the international work- 
ing group as well, and they are out there in the post collecting in- 
formation, sharing it with us; we are sharing it with them. So, we 
do work closely and help each other, but their systems are not 
being integrated with ours. 

Mr. Horn. OK, how about the Department of Agriculture, Ms. 
Reed, are you going to be able to give them something on April 
15th? 

Ms. Reed. We will be able to provide something, I will tell you 
that I think that it will require additional work, particularly the 
section on food safety, where we serve as the lead agency. I think 
we have pretty good command of what we have been doing within 
USDA, but we need to reach out to our partners across the Federal 
sector to assure we have incorporated their work, and quite frank- 
ly, that may take us just a little bit longer to do, but we will meet 
that commitment, because we take it very seriously. 

Mr. Horn. One of the columns on our quarterly report card has 
been the contingency plan. A lot of agencies have said it is the U.S. 
Post Office, in other words, mailed the checks, rather then elec- 
tronically deposit. We then had a hearing with the U.S. Postal 
Service, and they have no contingency plan. So I find that rather 
interesting, and we have the phrase “in progress” for most of the 
24 major executive agencies and Cabinet departments. I just would 
like to ask the four agency people here today, are we going to get 
in Congress another in-progress-type thing on your contingency 
plan, or do you have a contingency plan before the next quarterly 
report? 

Mr. Flyzik. At the Treasury Department we established March 
31st, this past March, as the date for all of our bureaus to work 
on business continuity and contingency plans. On March 31st, all 
but four of the bureaus had those plans into my office; the other 
ones are coming in now or will be in very shortly. We are going to 
do an analysis of those plans and put them together to come up 
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with a Treasury-wide approach. So, we feel at Treasury we are 
ahead of the curve a little bit in this particular area and will look 
forward to reporting to you as we do the analysis of where we 
stand on the plans. 

Mr. Horn. State? 

Mr. Burbano. For the State Department, we have 59 mission- 
critical systems. Out of the 59, we have 47 systems that have been 
completely finished and verified; 12 are in the mist of being final- 
ized, and we plan to have those finalized by June. 

Mr. Horn. So you are saying, you don’t need a contingency plan? 

Mr. Burbano. Oh, no, no, no. I am saying we have a contingency 
plan for each of them. 

Mr. Horn. For each of them? 

Mr. Burbano. Right, that is why I was saying, out of those 59, 
47 are solid green. 

Mr. Horn. Fine. How about the Agency for International Devel- 
opment? 

Mr. Nygard. We are in the process of completing our contingency 
plans. We expect them to be completed by June 30. So, for our next 
quarterly report you will get an “in-progress” from us, but progress 
is going as per schedule, and we will be implementing those plans 
by the beginning of the summer. 

Mr. Horn. Agriculture? 

Ms. Reed. We sent out guidance to our agencies last fall on busi- 
ness continuity and contingency planning. I have received the first 
draft from all agencies within tJSDA, except for one; I expect to 
have that one shortly. We have been reviewing that draft, and I 
can tell you that it is version one. We know we will have more 
work to do, but we feel relatively confident that we will have a 
strong business continuity and contingency plan in place by June 
15th. 

Mr. Horn. Well, I thank all of you. I am going to have to leave 
for another meeting, and thank you, Ms. Chairman. 

Mrs. Morella. Thank you, Mr. Chairman. 

And I am going to just ask one other question. Actually — I don’t 
know — maybe it was in your testimony, Mr. Burbano, but it was 
reference to the year 2000 Program Management Office’s strike 
teams. What do the strike teams do? Sounds like terrorism to me. 

Mr. Burbano. Well, we needed a strike team. You know, when 
I came on board we were zero compliant, and, you know, it took 
a lot to get us to 90 percent within 11 months. So, what I did, with 
my Deputy CIO for year 2000, is we got together and we decided 
we needed some strike teams to come in to not only do analysis, 
but provide assistance to each bureau to get us up there quickly 
in our steep curve of implementation. And they have actually pro- 
vided the assistance, besides the analysis, in order to do test vali- 
dations for helping contingency plans, for helping remediate, and 
so forth. So in all phases they have helped out, and continued to 
help out, the bureaus. 

Mrs. Morella. It just seems to me, from what has been stated 
in your wonderful testimony and response to our questions, that we 
are looking to April 15th for a view of the critical programs beyond 
what you have told us today: plans, milestones, also business con- 
tinuity plans that I think is so important, and then as we go on 
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to the end-to-end testing. So much more needs to be done, but I 
just am very much impressed with the progress that has been 
made. And as somebody who cares, as Mr. Horn does, very much 
about Federal employees, I do want to applaud you for responding 
to the challenge and the task. It is not all over yet, but, again, your 
cooperation in so doing I hope is a model for the States and local 
governments. Again, we will be back to you and hope you will be 
back to us about it. 

So I want to thank you all for coming before us. Thank you, Ms. 
Lee, and Mr. Willemssen, and Ms. Reed, Mr. Nygard, Mr. Burbano, 
and Mr. Flyzik. 

And I wanted to pick up the tradition that was established by 
Chairman Horn, and that is to acknowledge the staff who helped 
to put the committee hearing together: J. Russell George, who is 
with the Subcommittee on Government Management, Information, 
and Technology; Matt Ryan, senior policy director for GMIT; 
Bonnie Heald, who is the director of communications; Mason 
Alinger, who is the clerk; Richard Lukas, the intern. Technology is 
Jeff Grove, staff director; Ben Wu, professional staff member; Joe 
Sullivan, the clerk. And on the minority side. Faith Weiss, who is 
the counsel; Earley Green, staff assistant; Michael Quear; Marty 
Ralston, committee staff, and our court reporter, Kristine Mattis. 

And I thank you all, and the joint committee is now adjourned. 

[Whereupon, at 3:25 p.m., the subcommittees were adjourned.] 
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